🟠 High | Source: The Hacker News
A malvertising campaign called SourTrade, active since late 2024, tricks victims’ browsers into assembling a Windows executable from separate pieces rather than downloading a single malicious file. It impersonates well-known trading platforms such as TradingView, Solana, and Luno to target retail traders, using the legitimate Bun JavaScript runtime as its payload base. This fragmented delivery approach is designed to evade security tools that inspect complete files or block known malicious URLs.
Security Architect’s Take: Enforce strict Content Security Policy (CSP) headers and browser isolation for any corporate environments where users access financial platforms, and ensure endpoint detection tools are configured to flag unusual use of runtimes like Bun outside approved software inventories. Consider blocking ad network traffic at the perimeter for non-essential users, and add TradingView, Solana, and Luno impersonation indicators from the Confiant report to your threat intelligence feeds.
Original advisory: Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable