JSCeal Crypto-Stealing Malware Ships as V8 Bytecode and Replays Stolen Cookies to Bypass Google Authentication

Check Point details JSCeal, a heavily obfuscated JavaScript cryptocurrency stealer compiled to V8 bytecode (.jsc) and run by a bundled Node.js runtime, spread via malvertising through fake TradingView and trading sites; it steals browser credentials, cookies…

Check Point Research has published an analysis (presented at Black Hat USA 2026) of JSCeal, a cryptocurrency stealer built as heavily obfuscated JavaScript — obfuscated with javascript-obfuscator using RC4-protected strings, control-flow flattening and proxy functions — and compiled to V8 bytecode (.jsc) that runs under a bundled Node.js runtime to evade JavaScript analysis tools. It is distributed through malvertising, including fake TradingView installers and fake trading sites posing as Solana, Luno and TradingView, overlapping the WEEVILPROXY/MeadowLocust and SourTrade campaigns. The two reports differ on the timeline: The Hacker News says the SourTrade campaign, which assembles the malware in browser memory, has been active since late 2024 across 12 countries, while Security Affairs says Check Point has tracked JSCeal since early 2025. Once executed, JSCeal harvests cookies, passwords and OAuth tokens from Chromium browsers, steals Telegram sessions, records keystrokes and screenshots, and intercepts HTTPS traffic using attacker-controlled certificates. It installs a local proxy with service-specific handlers (targeted overrides) that intercept and rewrite content for Binance, Bybit and Ledger users, and it replays stolen Google session cookies to bypass Google authentication and automate Google account takeover. Later samples added AES-256-CBC encryption with externally supplied keys and expanded targeting to macOS. To analyze the malware, Check Point extended the open-source View8 decompiler into a static deobfuscation pipeline that recovered readable code from 23 samples.

• JSCeal is a cryptocurrency stealer delivered as heavily obfuscated JavaScript compiled to V8 bytecode (.jsc), executed by a bundled Node.js runtime; obfuscation uses javascript-obfuscator with RC4-protected strings, control-flow flattening…
• Distributed via malvertising: fake TradingView installers and fake trading sites posing as Solana, Luno and TradingView, overlapping the WEEVILPROXY/MeadowLocust and SourTrade campaigns.
• Timeline discrepancy: The Hacker News reports the SourTrade campaign, which assembles the malware in browser memory, has been active since late 2024 in 12 countries; Security Affairs says Check Point has tracked JSCeal since early 2025.
• Steals cookies, passwords and OAuth tokens from Chromium browsers plus Telegram sessions; records keystrokes and screenshots; intercepts HTTPS traffic with attacker-controlled certificates.
• Replays stolen Google session cookies to bypass Google account authentication and automate Google account takeover.
• Installs a local proxy with service-specific handlers and targeted overrides that intercept and rewrite content for Binance, Bybit and Ledger users.
• Later samples add AES-256-CBC encryption with externally supplied keys and expand targeting to macOS.
• Check Point, presenting at Black Hat USA 2026, extended the open-source View8 decompiler into a static deobfuscation pipeline that recovered readable code from 23 samples.