45
30
35
30
42
JSCeal Hides Crypto Malware in V8 Bytecode
Check Point details JSCeal, a crypto-stealing malware delivered as compiled V8 bytecode, and built a decompiler pipeline to expose its capabilities.
JSCeal, tracked by Check Point Research since early 2025, is a cryptocurrency stealer delivered as heavily obfuscated JavaScript compiled to V8 bytecode (.jsc) and run by a bundled Node.js runtime. Check Point, presenting at Black Hat USA 2026, extended the open-source View8 decompiler into a pipeline that recovered readable code from 23 samples, revealing theft of browser credentials and cookies, Telegram sessions, keystrokes, screenshots, HTTPS traffic interception with attacker-controlled certificates, and automated Google account takeover. Targeted overrides rewrite content for Binance, Bybit, and Ledger users. Later samples added AES-256-CBC encryption with externally supplied keys and expanded targeting to macOS.
58
Trends in Web Threats: Old Web Skimmer Still Active Today
Unit 42 detected 577,000 landing URL incidents in Q1 2022, with an old web skimmer family still actively stealing payment card data.
Palo Alto Unit 42 detected 577,275 landing URL incidents (116,643 unique) and 2,043,862 malicious host URL incidents (180,370 unique) between January and March 2022. Web threat volumes declined after the November 2021 holiday peak, but an old web skimmer family remained active. Business and economy sites overtook personal sites as the most common apparently benign entry points. Most malicious domains geolocated to the United States, Germany, and Russia, though proxy servers and VPNs obscure true locations.
27
Recent Trends in Internet Threats: Common Industries Impersonated in Phishing Attacks, Web Skimmer Analysis and More
Unit 42 analyzed 67 million malicious URLs and domains in H2 2022, a 52% increase, highlighting phishing impersonation and web skimmer trends.
Unit 42 observed more than 67 million unique malicious URLs, domains and IPs between July and December 2022, a 52% increase over the first half of the year. Malicious JavaScript detections grew 99.3%, with over 4 million malicious JS samples hosted on 4.8 million URLs. Over 85% of hosting infrastructure was concentrated in eight countries, led by the United States, Brazil and China. The report also analyzes industries spoofed in phishing pages and includes a web skimmer case study on a Tranco top 1 million website.
28
42
30
57
42
30
30
42
30
⚡ Weekly Recap: Fortinet Exploited, China's AI Hacks, PhaaS Empire Falls & More
60
50
42
30
60
30
45
30
42
42
30
30
35
30
42
30
57
30
30
60
35
42
45
42