Threat Brief — 2026-07-25 — Browser-Built Malware Evades Detection

Executive summary: A newly disclosed malvertising operation dubbed "SourTrade" sidesteps traditional URL- and hash-based malware detection by delivering payload fragments to the victim's browser, which then assembles the final Windows executable locally using a legitimate Bun runtime. This "fileless assembly" approach means no single malicious file is ever fetched from a static URL, severely limiting the effectiveness of reputation-based blocking. The technique is a meaningful evolution in malvertising tradecraft and warrants attention from SOC teams relying on web-proxy or AV signature controls.

Top items

• SourTrade malvertising assembles malware in-browser via Bun runtime. A malvertising campaign tracked by Confiant delivers payload pieces to the victim's browser rather than serving a complete malicious executable from a fixed URL. The browser then reconstructs the final Windows binary using a legitimate Bun runtime as its base, evading URL-reputation and static-hash detection. This is a notable shift for malvertising operators and could complicate detection for organisations that rely primarily on web-gateway blocking. (src: The Hacker News)

Themes

• Browser-as-builder tradecraft: SourTrade's in-browser assembly approach mirrors broader trends where adversaries abuse legitimate runtimes and living-off-the-land techniques to reduce forensic footprint. Expect detection teams to need behaviour-based analytics (e.g., monitoring for unusual runtime child processes from browser contexts) rather than relying on file-hash or URL-reputation alone.