Dubbed a malware operation sour business Victims’ browsers are being engineered to create the final Windows executable using the legitimate BUN runtime as a base, rather than serving a full malicious file from a certain URL.
Confiant, which detailed the campaign on July 23, 2026, said it has been operating since late 2024 and impersonates TradingView, Solana, and Luno to target retail traders and cryptocurrency investors in 12 countries in 25 languages.
Its landing pages fingerprint visitors, showing a blank page to suspicious researchers and bots while selected targets receive a concrete copy of the impersonated service. The defense against this is simple: install the trading and wallet software from the vendor’s own site, not from an ad.
The documented series does not rely on browser vulnerabilities or remove the Mark of the Web (MotW). Confiant’s analysis documents the delivery, not the execution, of the file inside the browser, and does not establish whether the final download starts automatically or requires a click.
The landing page starts preparing the delivery path without waiting for the download click. This registers a page-scoped ServiceWorker /sw.jsThen creates a SharedWorker from JavaScript already embedded in the page, so the worker source is never exposed as a separate fetch.
sharedworker requests /configWhich returns a template, a secondary runtime URL, and session-specific random values. The browser retrieves and decompresses a clean BUN runtime from that other domain, PureLogicBox[.]In the published sample response org.
Base64 blobs in the configuration supply a portable executable (PE) header, section tables, and a .bun Section containing malicious JavaScriptCore bytecode app.js. Bun runs on Apple’s JavaScriptCore engine and supports compiling applications and bytecode into legitimate standalone Windows executables.
The worker then generates a large pseudo-random byte stream using AES in counter mode (AES-CTR). It then follows the supplied template as a byte-copy recipe, combining categories selected from the bun runtime, generated stream, and attacker-controlled executable content.
Each victim may receive a separate collected file: each containing the seed and rotating size. /config The response changes the hash while maintaining the executable payload code. “No ready-made malware ever exists on a network,” wrote Michael Steele of Confiant’s threat intelligence team. There is no complete binary, although PE structures and bytecode come as base64. /config.
Once assembled, the page sends the executable to the ServiceWorker as a readable stream. A hidden iframe navigates to the same base URL, and the worker returns the generated bytes Content-Disposition Attachment header. The resulting MotW record identifies the landing page as the download source, not the separate domain that provides the BUN runtime. MotW itself exists.
This method evolved from activity tracked by Confiant through April 30, 2026, when pages loaded StreamSaver.js, an open-source stream-download library, from their author’s GitHub page address. This left a recorded download path pointing to the library’s GitHub URL. Current Pages maintains its streaming architecture, which includes streamsaver: message name, but it will no longer be accessible from GitHub.
Bitdefender documented a related TradingView malvertising cluster in September 2025, identifying its final payload as stealing Check Point tracks to JSCeal and VidSecure as WeevilProxy.
Confient identifies shared campaign and executable attributes but does not demonstrate that the three published samples carry that payload. The report also states that Bitdefender found a modified BUN executable in this cluster.
Hacker News found no mention of Bun in the September 2025 post Confident Link, in which its loader detection is named variant.Denosnoop.Mart.1. Credential theft, keylogging, traffic interception, wallet theft, and remote-access capabilities recorded in a previous campaign may not yet be assigned to current files.
Hacker News has contacted Confiant for clarification regarding Bitdefender’s earlier findings and will update this story with any response.
There is no software patch to apply. This evasion is more narrow than it first appears. Confiant’s own practical-implications section puts it more politely: The unique per-session build limits the value of simple hash-based identification. Attacker-controlled PE content and bytecode still traverse the network.
Defenders should investigate the entire chain from ad referrals and cloaked landing pages /config requests, secondary-domain runtime fetches, and ServiceWorker downloads, rather than considering a single network or file artifact as deterministic.
Confiant published three SHA-256 hashes and a list of malicious domains, 96 by The Hacker News’ count. The company did not name any actors and stopped its analysis as soon as the files arrived on disk.
