Cybersecurity researchers from Check Point Research have analyzed JSCeal, a sophisticated malware compiled as V8 JavaScript (JSC). The malware is capable of credential harvesting, surveillance, and traffic interception. JSCeal is notably able to bypass Google authentication by stealing session cookies, effectively circumventing multi-factor authentication protections. The payloads are protected using javascript-obfuscator with multiple advanced obfuscation techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers. This makes analysis and detection significantly more challenging. The malware represents a growing trend of sophisticated browser-targeting threats that can undermine modern authentication mechanisms.
JSCeal is a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-interception capabilities. It is protected using javascript-obfuscator with multiple obfuscation layers: (1) renaming functions and variables with nonsensical identifiers, (2) splitting strings into RC4-encoded chunks reconstructed via decoder functions, (3) control-flow flattening using infinite loop and state variable switch statements, and (4) proxy helper functions wrapping basic operations. The malware is distributed via malvertising campaigns on Facebook and Google using fake cryptocurrency trading sites (impersonating TradingView, Solana, Luno) that prompt users to download bogus installers. It is delivered via two ZIP archives through PowerShell — one containing the Node.js runtime and one containing the main payload. A related operation called SourTrade delivers malware assembly instructions to the victim's browser, retrieving clean legitimate files from separate infrastructure and assembling final malware in memory. JSCeal targets Chromium-based browsers (Chrome, Edge, Brave, Opera, Opera GX, Avast Secure Browser, Vivaldi, Cốc Cốc) to enumerate profiles and extract cookies, passwords, OAuth tokens, and saved secrets. It uses stolen cookies to reconstruct browser sessions and perform active session replay attacks to bypass Google authentication. A secondary module records keystrokes and takes screenshots. JSCeal also installs a local proxy with certificate generation and installation, and modifies web content for specific services including Binance, Bybit, and Ledger — capturing account data and cryptocurrency balances. Check Point developed a fully static deobfuscation pipeline to decode compiled V8 JavaScript bytecode. The campaign has been active since late 2024, targeting retail traders and cryptocurrency investors across 12 countries in 25 languages, primarily in Asia Pacific and Latin America.
1. Avoid downloading software from unverified sources, especially trading platform installers promoted via social media or search ads. 2. Be cautious of advertisements on Facebook and Google redirecting to cryptocurrency or trading sites. 3. Regularly audit and clear browser cookies, especially for sensitive accounts. 4. Enable hardware security keys (FIDO2) for Google and cryptocurrency accounts, as session cookie replay cannot bypass hardware-bound authentication. 5. Monitor for unexpected local proxy installations or new root certificate authority installations on endpoints. 6. Use endpoint detection and response (EDR) tools to detect PowerShell-based ZIP extraction and Node.js execution from unusual locations. 7. Block or alert on enumeration of browser user-data directories by non-browser processes. 8. Monitor network traffic for unexpected proxy configurations or certificate anomalies. 9. Use the static deobfuscation pipeline published by Check Point (https://github.com/hasherezade/jsc_deobfuscator) to analyze suspected JSCeal samples. 10. Cryptocurrency platform users (Binance, Bybit, Ledger) should review account activity for unauthorized access or balance changes.
Fake cryptocurrency trading sites impersonating TradingView, Solana, Luno, Malicious Facebook and Google advertisements redirecting to fake trading sites, Two ZIP archives delivered via PowerShell (one containing Node.js runtime, one containing main payload), Compiled V8 JavaScript (JSC) bytecode payload, javascript-obfuscator with RC4-protected strings, Local proxy installation with self-signed certificate generation, Browser user-data directory enumeration for credential and cookie theft, Session replay attacks against Google accounts, Keylogger and screenshot capability, Handlers targeting Binance, Bybit, and Ledger platforms
