The SourTrade operation represents a sophisticated shift in the delivery phase of the Phishing lifecycle. Instead of the traditional method where a victim downloads a static, malicious PE (Portable Executable) file directly, SourTrade leverages the client’s browser to stitch together the final payload. According to The Hacker News, this campaign has been active since late 2024, specifically targeting individuals involved in cryptocurrency and financial trading.
The campaign impersonates high-traffic platforms such as TradingView, Solana, and Luno. By utilizing malvertising—malicious advertisements injected into legitimate ad networks—the attackers redirect users to highly convincing clones of these sites. Once a victim is lured, the technical execution begins, deviating from standard malware delivery TTP patterns.
Bun Runtime Malware Evasion Techniques
The core innovation of SourTrade is its use of the Bun runtime. Bun is a legitimate, high-performance JavaScript runtime, similar to Node.js or Deno. In this campaign, the attackers deliver the Bun executable in fragments. The browser then executes scripts that download these “pieces” and reconstruct them on the local disk. This method is designed to bypass EDR and traditional network security appliances that scan for complete, known malicious signatures during the download phase.
When the browser builds the final Windows executable, it often evades simple heuristic detection. Because the initial downloads consist of non-executable data chunks or legitimate components of the Bun project, security tools may not trigger an alert until the assembly is complete and execution begins. Understanding how to detect SourTrade malware assembly requires a focus on browser-initiated file writes to non-standard directories and the subsequent execution of unsigned or newly created binaries by browser processes.
Technical Analysis of SourTrade Payload Construction
The assembly process typically involves several stages to ensure the final payload remains hidden from automated scanners. This SourTrade malvertising campaign technical analysis highlights the following workflow:
- Redirection: The user clicks a malvertising link masquerading as a legitimate trading tool update or platform download.
- Environment Profiling: The landing page checks for virtual machines, sandboxes, or specific SOC analyst tools to avoid detection by researchers.
- Chunked Delivery: The payload is broken into multiple obfuscated blobs, which are downloaded individually over HTTPS.
- Client-Side Assembly: JavaScript on the landing page uses the FileSystem API or similar browser capabilities to compile the blobs into a functional Bun runtime environment bundled with malicious scripts.
By the time an IoC is identified, the malicious code is already resident on the host. The final payload often serves as a downloader for further malware, such as info-stealers or Ransomware precursors, which then attempt Lateral Movement within the victim’s network or focus on exfiltrating seed phrases and credentials.
Mitigation and Defense Strategies
Defenders should focus on a multi-layered approach to counter these browser-side assembly threats. Standard signature-based detection is insufficient against such modular delivery mechanisms. The following steps are recommended to mitigate the risk:
- Ad-Blocking and DNS Filtering: Preventing the initial redirect is the most effective defense. Organizations should deploy enterprise-grade ad-blocking and restrict access to newly registered domains (NRDs) that lack established reputation scores.
- Browser Security Policies: Implement Zero Trust principles at the browser level. Restrict the ability of browsers to execute complex scripts on unverified domains and monitor for excessive FileSystem API usage that could indicate payload assembly.
- Endpoint Monitoring: Configure SIEM and EDR tools to alert on browser processes (e.g., chrome.exe, msedge.exe) spawning shells or creating executable files in local app data folders. Pay particular attention to the execution of the Bun runtime if it is not a sanctioned tool in your environment.
- User Education: Inform users within the financial sector about the risks of downloading software from advertisements. Emphasize the importance of only using official, verified URLs for trading platforms and financial services.
By implementing these controls, organizations can better defend against the Bun runtime malware evasion techniques employed by the SourTrade actors and reduce the likelihood of a successful compromise.
Related: Claude.ai Malvertising: How Attackers Abuse Shared Chats for macOS Malware, Operation FlutterBridge: New FlutterShell Backdoor Targets macOS