A large-scale malvertising campaign, dubbed ‘SourTrade,’ is using fake Solana, Luno, and TradingView webpages to target retail traders. Instead of delivering a complete malicious executable, the campaign employs JavaScript to instruct victims’ browsers to assemble malware directly in memory. This technique, active since late 2024, leverages a legitimate Bun runtime to evade traditional file-based detection, making it harder to trace and block.