JSCeal Hides Crypto Malware in V8 Bytecode
Check Point details JSCeal, a crypto-stealing malware delivered as compiled V8 bytecode, and built a decompiler pipeline to expose its capabilities.
JSCeal, tracked by Check Point Research since early 2025, is a cryptocurrency stealer delivered as heavily obfuscated JavaScript compiled to V8 bytecode (.jsc) and run by a bundled Node.js runtime. Check Point, presenting at Black Hat USA 2026, extended the open-source View8 decompiler into a pipeline that recovered readable code from 23 samples, revealing theft of browser credentials and cookies, Telegram sessions, keystrokes, screenshots, HTTPS traffic interception with attacker-controlled certificates, and automated Google account takeover. Targeted overrides rewrite content for Binance, Bybit, and Ledger users. Later samples added AES-256-CBC encryption with externally supplied keys and expanded targeting to macOS.
- JSCeal ships as V8 bytecode to evade JavaScript analysis tools
- Check Point built a View8-based deobfuscation pipeline for 23 samples
- Stealer intercepts HTTPS and rewrites Binance, Bybit, Ledger content
- Can automate Google account takeover using stolen cookies
- Newer samples add AES-256-CBC layer and macOS targeting
- Vendors
- Check Point
- Malware
- JSCeal
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 581e2e2265d0c1509b3799c5a9039374 | encrypted payload we observed was generated on 2025-11-11 ( 581e2e2265d0c1509b3799c5a9039374 ). The AES key is not stored in the malware bundle itself. |
From the original article
5 min read at securityaffairs.com
JSCeal hides crypto-stealing malware in V8 bytecode, but researchers built a tool to decompile it and expose its advanced theft capabilities. JSCeal is a cryptocurrency stealer that Check Point Research has tracked since early 2025. Unlike most malware, it hides its code in a format that makes analysis much harder.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.