There’s a nice irony buried in a malvertising campaign that got picked apart this week: the malware doesn’t fully exist until your own machine builds it. Not “exists somewhere on a server you can’t reach.” Not “exists in an encrypted blob.” It simply isn’t a complete, scannable, signature-matchable thing until your browser assembles the last piece, on your hardware, using your CPU cycles. The attacker just handed you the kit and let you do the labor. That’s the kind of insult that should keep threat intel teams up at night, and it’s not the only story this week making the same point in a different accent.

Between a malvertising operation that builds its payload client-side and a wave of insurance phishing kits that hijack sessions in real time instead of harvesting passwords for later, the throughline is obvious once you see it: attackers have figured out that the moment something becomes a fixed, inspectable artifact is the moment it becomes detectable. So they’ve stopped producing fixed artifacts. Good cybersecurity practice has spent two decades getting very good at catching files and credentials sitting still. Attackers responded by not letting anything sit still.

The Browser That Builds Its Own Gun

Confiant’s writeup on the campaign it calls SourTrade, running since late 2024 and impersonating TradingView, Solana, and Luno to hook retail traders, describes something genuinely clever and genuinely infuriating. Instead of serving one complete Windows executable from a fixed URL, the ad chain delivers pieces. A legitimate Bun runtime gets pulled down as the chassis, and the browser stitches the rest together locally, producing the final malicious binary only at the point of execution.

Think about what that does to every static-analysis pipeline built over the last fifteen years. There is no single file to hash and blocklist, because the file that matters doesn’t exist until it’s already running on the victim’s machine. There’s no fixed download URL to add to threat-protection feeds, because the components are staged and reused across sessions. A sandbox that detonates the ad in isolation might see a Bun runtime doing something boring and move on, because the actual malicious assembly step depends on context the sandbox doesn’t reproduce. This is malware that’s aware it’s being watched and simply declines to finish forming until the audience leaves the room.

From Steal-Now-Use-Later To Steal-And-Use-Now

CTM360’s research into insurance-sector phishing describes the same instinct wearing different clothes. The old playbook was patient: trick a victim into typing a username and password, stash the credentials, and cash them in whenever it’s convenient, sometimes weeks later, sometimes sold to someone else entirely. That gap between theft and use was a gift to defenders. It gave incident response teams a window to catch anomalous logins, force password resets, and treat a credential dump as a warning rather than a done deal.

What CTM360 is now tracking closes that window to nearly zero. The phishing kits proxy the live session in real time, capturing not just a password but the authenticated session itself, sometimes including the MFA step, as the victim types it. There is no dump to sell. There is no delay to detect. The account is hijacked in the same interaction where the victim thought they were just logging in. That’s not a credential-theft problem anymore. It’s an identity-hijacking problem, and it plays out on a timeline measured in seconds, not the days or weeks that most incident response playbooks assume they’ll have.

Why Your Cybersecurity Stack Is Still Fighting Last Decade’s Clock

Here’s the uncomfortable part. Most cybersecurity investment over the past ten years assumed a detection window that these two techniques are specifically designed to erase. Antivirus and EDR are built around recognizing artifacts, files, hashes, known-bad domains. Firewall and brute-force protections are built around recognizing patterns of repeated, distinguishable requests over time. Both assumptions break down when the artifact only exists for a moment and the “attack” looks, from a network perspective, identical to a real login.

This doesn’t mean the old controls are worthless. It means they’re necessary but no longer sufficient, and treating them as the whole strategy is how organizations get surprised. Defense in depth was never supposed to mean “five tools that all watch for the same kind of thing.” It means layering controls that catch different failure points, so that when the perimeter layer gets bypassed by design, something behind it still notices.

• Assume session tokens are now as valuable as passwords, and rotate/expire them aggressively, especially after any anomaly in device fingerprint or geolocation.
• Push for phishing-resistant MFA (FIDO2/passkeys) rather than OTP or push-based MFA, since real-time proxy kits are specifically built to relay OTP codes as fast as a human can type them.
• Treat browser-based ad networks and third-party ad tech as an untrusted execution environment on managed endpoints; script-blocking and strict CSP policies aren’t paranoia here, they’re basic security hardening.
• Shift threat detection budget toward behavioral and session-anomaly monitoring, not just signature and file-hash matching, since the newer techniques are explicitly engineered to produce no stable signature.
• Shorten your assumed detection window in incident response planning. If your runbook assumes days between compromise and impact, rewrite it around minutes.

The Only Honest Move Is Assuming Compromise Faster

None of this is an argument for giving up on prevention. It’s an argument for admitting that prevention alone was always a bet, and the odds just got worse. A security program that only detects finished, static threats is going to miss an entire and growing category of attacks that are deliberately unfinished until the last possible moment. The fix isn’t a new box to buy. It’s accepting that “detect the bad file” and “detect the bad login” are shrinking categories, while “detect the bad behavior, right now, while it’s happening” is the category that actually has a future.

That’s a harder sell internally, because it means investing in monitoring and response capability instead of a shiny prevention product you can point to in a board meeting. But the attackers in both of this week’s stories didn’t build anything exotic. They just noticed where defenders were looking and made sure nothing incriminating would be there when the scan ran. Cybersecurity teams that keep scanning for finished products are going to keep finding nothing, right up until the incident report explains why.

Sources

• Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
• CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking