A malvertising operation tracked as SourTrade is evading detection by never delivering a complete malware file. Instead, the campaign makes victims’ browsers download individual components and assemble the final executable using Bun, a legitimate JavaScript runtime, directly in the browser session. Security firm Confiant detailed the technique on July 23.
The attack starts with a malicious ad that redirects victims through multiple domains before reaching a landing page. That page triggers a chain of smaller downloads, each containing a fragment of what will become the final Windows executable. Bun, an open-source runtime designed for JavaScript and TypeScript, acts as the assembly environment, piecing the fragments together and executing the result without any single suspicious binary ever touching the filesystem as a whole.
This modular approach bypasses traditional signature-based detection because no single network request or downloaded file looks malicious in isolation. Security teams should deploy behavioral detection rules that monitor for runtime environments like Bun being used in browser contexts, and block the known redirect domains associated with the SourTrade infrastructure.
