Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable

A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base instead of serving one complete malicious file from a fixed URL. Confiant, which detailed the campaign on July 23, 2026, said it has operated since late 2024 and impersonated TradingView, Solana, and Luno to target retail traders and

The article reports a malvertising campaign, dubbed SourTrade, that uses browser-based assembly to build a Windows executable from pieces, impersonating TradingView, Solana, and Luno to target retail traders and cryptocurrency investors across multiple countries.[1] The core issue is malware delivery and social engineering rather than a direct AI system attack, so this is best treated as a broader malicious-use and security-monitoring concern. RealGround should prioritize advisory review and red-teaming to assess how similar browser-based delivery chains could bypass detection or user trust controls.