A malvertising campaign called SourTrade makes victims' browsers download and assemble malicious executables using a legitimate runtime.