SourTrade malvertising builds a malicious .exe directly in the browser

Colleagues, I’d like to flag a cybersecurity case: the SourTrade malvertising campaign assembles a malicious Windows file directly in the browser, rather than delivering a ready-made sample.

• Attackers posed as TradingView, Solana, and Luno.
• The browser, via ServiceWorker and SharedWorker, requests /config and then receives the Bun runtime plus build data for the .exe.
• The file can be rebuilt differently for each session, complicating hash-based detection.
• MotW is preserved, while the chain runs through ads and cloaking.

Why it matters: defense should target the full chain, from ad referral to download and hosting domains.

Where would you start investigating in such a setup?

#cybersecurity #malvertising #Windows #ThreatIntelligence