JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies
Check Point details JSCeal, a V8-compiled JavaScript stealer that replays stolen cookies to bypass Google authentication, spread via crypto malvertising.
Check Point Research's new report analyzes JSCeal, a compiled V8 JavaScript malware obfuscated with javascript-obfuscator using RC4-protected strings, control-flow flattening, and proxy functions. Delivered through fake TradingView installers on malvertising sites overlapping the WEEVILPROXY/MeadowLocust and SourTrade campaigns, it harvests cookies, passwords and OAuth tokens from Chromium browsers, records keystrokes and screenshots, and can replay stolen Google session cookies to bypass authentication. It also installs a local proxy with service-specific handlers for Binance, Bybit, and Ledger to intercept and modify cryptocurrency-related traffic.
- Session replay with stolen cookies bypasses Google account authentication
- Distributed via malvertising: fake trading sites posing as Solana, Luno, TradingView
- SourTrade campaign assembles malware in browser memory; active since late 2024 in 12 countries
- Surveillance module records keystrokes and screenshots; proxy intercepts Binance, Bybit, Ledger traffic
- Check Point built a static deobfuscation pipeline for compiled V8 bytecode
- Threat actors
- WEEVILPROXYMeadowLocustSourTrade
- Malware
- JSCeal
- Organizations
- Check PointConfiantBitdefender
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have unpacked JSCeal, a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-interception capabilities. "The payloads are protected with javascript-obfuscator, using multiple techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers," Check Point Research said in a
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.