Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
Malvertising campaign "SourTrade" uses browser-side assembly to construct Windows executables, ensuring no complete malware binary exists on the network during transmission. Attackers leverage a legitimate Bun runtime and JavaScriptCore bytecode, combining them with attacker-controlled PE headers and pseudorandom data via ServiceWorkers and SharedWorkers. The technique generates unique file hashes per session by rotating AES-CTR seeds, effectively bypassing static hash-based detection mechanisms
Analysis
TL;DR
- Malvertising campaign "SourTrade" uses browser-side assembly to construct Windows executables, ensuring no complete malware binary exists on the network during transmission.
- Attackers leverage a legitimate Bun runtime and JavaScriptCore bytecode, combining them with attacker-controlled PE headers and pseudorandom data via ServiceWorkers and SharedWorkers.
- The technique generates unique file hashes per session by rotating AES-CTR seeds, effectively bypassing static hash-based detection mechanisms.
- Campaign targets retail cryptocurrency traders by impersonating TradingView, Solana, and Luno, using sophisticated cloaking to evade researcher and bot detection.
Why It Matters
This represents a significant evolution in evasion techniques, shifting the burden of malware construction from the server to the client's browser environment. For security practitioners, it highlights the limitations of traditional signature-based defenses and underscores the need for behavioral analysis and comprehensive chain monitoring rather than relying on single-point artifact detection.
Technical Details
- Assembly Mechanism: The attack registers a page-scoped ServiceWorker (
/sw.js) and builds a SharedWorker from embedded JavaScript. This worker fetches configuration and a clean Bun runtime from a secondary domain (purelogicbox[.]org). - Payload Construction: The SharedWorker retrieves Base64-encoded PE headers, section tables, and malicious JavaScriptCore bytecode (for
app.js). It generates a large pseudorandom byte stream using AES-CTR and combines these elements according to a template to assemble the final executable in memory. - Evasion Strategy: By assembling the file client-side, the final binary never traverses the network as a whole. Each victim receives a uniquely hashed file due to session-specific random values, neutralizing static hash-based blocking.
- Delivery Chain: The assembled executable is passed to the ServiceWorker as a readable stream. A hidden iframe navigates to a same-origin URL, triggering the ServiceWorker to return the bytes with a
Content-Dispositionattachment header, preserving the Mark of the Web (MotW) from the landing page.
Industry Insight
- Shift to Behavioral Analysis: Defenders must move beyond static file hashing and implement monitoring for anomalous browser behaviors, such as unusual ServiceWorker registrations or unexpected data streams from legitimate runtimes like Bun.
- Supply Chain Trust Risks: The use of legitimate tools (Bun) for malicious purposes demonstrates the growing risk of "living off the land" techniques in web environments. Security teams should scrutinize how legitimate software components are being invoked in unexpected contexts.
- Holistic Threat Hunting: Investigation should focus on the entire delivery chain—from ad referral and cloaked landing pages to configuration requests and secondary domain fetches—rather than isolating individual network artifacts which may appear benign in isolation.
Disclaimer: The above content is generated by AI and is for reference only.