The economics of malware distribution have always favoured obfuscation over subtlety. But a shift documented in late 2024 suggests a refinement: instead of uploading a complete executable to a hosting provider's servers, threat actors are now sending malware in fragments, letting the victim's browser do the assembly work. The SourTrade campaign, detailed by Confiant, exemplifies this trend.
Fragmenting the Attack Surface
Traditional malvertising relied on serving a complete malicious binary from a hosting provider's infrastructure. This approach left traces: DNS logs, CDN caches, endpoint detection and response (EDR) telemetry on the victim machine, and hosting provider abuse reports all pointed to the same artefact. Uploading a single 5 MB executable to a shared hosting provider is also conspicuous—it's a known anti-pattern that triggers automated malware scanning.
SourTrade circumvents this by splitting the final payload into multiple fragments, each delivered over separate HTTP requests. The browser's JavaScript engine then reconstructs and executes the complete binary in memory. This approach offers several technical advantages. First, individual fragments may not trigger signature-based detection because no single piece contains the recognisable malware signature. Second, the reconstruction happens client-side, meaning the hosting provider never touches the complete executable. Third, the traffic pattern looks like normal web browsing rather than a direct file download.
Abusing Legitimate Runtime Environments
What makes this campaign particularly noteworthy is its use of the Bun runtime—a legitimate JavaScript runtime environment—as the foundation. Instead of embedding malicious code directly, SourTrade delivered fragments that Bun itself would execute, turning a trusted tool into an unwitting malware launcher. This technique mirrors earlier patterns in which threat actors hijacked npm packages or abused legitimate software to distribute payloads.
The choice of Bun is instructive. It's lightweight, increasingly used in edge computing and serverless environments, and less scrutinised than Node.js. From a hosting and infrastructure perspective, this signals that attackers are studying the software supply chains that modern web services depend on. If a shared hosting provider allows Bun execution or if Bun libraries are distributed through internal package managers, the risk surface expands considerably.
Detection and Mitigation Challenges
Conventional endpoint security tools struggle with in-browser assembly because the malware never exists as a complete file on disk—only as fragments in memory. EDR products that rely on file hashing or static analysis will miss the payload entirely. Network-level detection is also hampered because the traffic pattern (multiple small requests to seemingly innocuous URLs) resembles normal ad delivery.
For hosting operators and infrastructure teams, this underscores the limits of perimeter-only defences. A malicious ad network can operate within an advertising partner's legitimate infrastructure, serving fragments through the same trusted domain that legitimate ads use. No amount of firewall rules or IP reputation blocking will catch it if the source is a compromised or attacker-controlled advertising partner with a good reputation history.
Detection, therefore, shifts upstream: to the ad networks themselves, to the browsers serving them, and to behavioural monitoring of process execution. Some web browsers have begun sandboxing JavaScript more aggressively, and content security policies can restrict script execution. But these are browser-vendor responsibilities, not infrastructure-operator ones.
Implications for Hosting Providers
SourTrade's approach has several implications for anyone operating shared hosting, reseller platforms, or advertising infrastructure. The campaign, first detailed by Confiant in July 2026, predominantly targeted retail traders by impersonating legitimate financial platforms like TradingView and Solana. This isn't accidental—it reflects attacker focus on high-value targets. But the technique is portable and will likely spread to other niches.
If your infrastructure hosts advertising networks, investment in outbound traffic analysis and request pattern recognition becomes critical. Fragmenting payloads across many requests is detectable if you're looking for the pattern: a single user's session making dozens of requests to unusual endpoints, with no caching, over a short time window. Web application firewalls and log aggregation tools can surface these anomalies, though only if you're monitoring for them.
For hosting providers that allow arbitrary code execution (including Bun, Node.js, or Python), the risk is that a legitimate application might be compromised and then used as a staging ground for fragment reassembly. This argues for strict isolation between customer accounts, aggressive monitoring of egress traffic, and regular audits of what runtimes are installed and what permissions they hold.
A Persistent Cat-and-Mouse Dynamic
The SourTrade campaign demonstrates that malware distribution is not static. As endpoint detection has improved, attackers have responded by distributing the problem across more layers and delegating assembly to the victim's own infrastructure. This is fundamentally an economics problem: hosting providers are investing in detection and abuse response, so attackers must raise the cost of detection faster than the cost of distribution rises.
The long-term implication is that malware distribution will continue to become more distributed and more reliant on compromising legitimate infrastructure. Hosting operators who assume their platform will never be a vector for advanced malware delivery are making a dangerous bet. Regular security audits, restrictive privilege models, and aggressive egress monitoring are not optional extras—they're baseline hygiene for any provider serving a large user base.
