SourTrade malvertising campaign uses fragmented payloads and Bun runtime to evade detection

SourTrade represents a maturation in malvertising tactics by solving a fundamental detection problem: serving monolithic executables from predictable URLs creates trivial indicators of compromise for network defenders and ad-network security teams. By fragmenting the payload and orchestrating assembly within the victim's browser using Bun (a legitimate Node.js-compatible runtime), the operators push execution context into an environment where traditional malware analysis tools are rarely deployed.

The technical approach is sound. Fragments can be served across multiple ad impressions, different domains, or obfuscated within ad content, making each individual component appear benign. The Bun runtime, being legitimate software, executes code without triggering heuristics tied to known malware frameworks. This is analogous to Living-off-the-Land techniques but applied to payload delivery rather than post-execution persistence.

Retail traders are high-value targets because they operate in environments with elevated risk tolerance for third-party financial tools, often run client applications with minimal endpoint protection, and frequently access trading platforms through browsers where malvertising impressions are common. The impersonation of TradingView, Solana, and Luno builds trust and contextual plausibility. The operational security is notably mature: the campaign sustained for 18+ months suggests either significant funding or profitable monetisation of compromised systems.

Defenders face a layered challenge. Ad-network teams must move beyond URL reputation and implement runtime analysis of advertisement payloads. Endpoint defenders should monitor Bun executions, particularly those spawning child processes or accessing sensitive registry keys. Organisations serving retail clients should educate users on phishing risks tied to financial platforms and consider restricting untrusted script execution in browser contexts. The broader implication is that payload fragmentation plus legitimate runtime abuse will become standard for high-confidence attacks, forcing detection logic to shift from artefact analysis to behavioural observation.

This campaign should prompt a reconsideration of how ad networks audit third-party JavaScript and how browsers handle in-memory payload assembly. The fact that Bun can be deployed without user awareness suggests vendors should improve transparency around runtime installation and execution within common browsing scenarios.