Malvertising Campaign “SourTrade” Assembles Malware in the Browser Using Bun Runtime
What Happened — The “SourTrade” malvertising operation has been delivering fragmented Windows payloads to browsers, which then re‑assemble the final executable using the legitimate Bun JavaScript runtime. The campaign, active since late‑2024, masquerades as trusted sites such as TradingView, Solana and Luno to target retail traders.
Why It Matters for Compliance & Audit Readiness
- The attack exploits the same trust assumptions that SOC 2’s Security principle expects organizations to document and mitigate (e.g., controls over third‑party content and user‑device hygiene).
- Continuous evidence of web‑filtering, endpoint detection, and security‑awareness training is essential to demonstrate that the organization can detect and respond to evolving malicious‑ad techniques.
Who Is Affected – Retail‑trading platforms, fintech SaaS providers, and any organization whose users browse the open web from corporate devices.
Recommended Actions –
- Map the incident to SOC 2 CC6.1 (Logical Access Controls) and CC7.1 (System Operations) to ensure controls cover malicious‑ad content.
- Deploy or tighten web‑content filtering and endpoint protection that can detect fragmented payload assembly.
- Refresh security‑awareness training to include malvertising detection and safe‑browsing practices.
Source: The Hacker News – Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
Technical Notes – The campaign uses legitimate Bun runtime (a JavaScript/TypeScript engine) as a delivery vehicle, avoiding static signatures. No specific CVE is cited; the threat relies on browser execution of remote script fragments. Data exfiltration potential is high once the assembled malware gains foothold.