Researchers at Check Point Research have published an in-depth technical analysis of JSCeal — malware compiled into V8 engine bytecode and distributed via fake cryptocurrency and trading applications. The malware can steal credentials and cookies from eight Chromium-based browsers, intercept and modify HTTPS traffic for cryptocurrency services (Binance, Bybit, Ledger), and replay sessions to bypass Google authentication. According to Check Point, in just the first half of 2025 around 35,000 malicious ads were identified, with a conservative reach of roughly 3.5 million accounts in the European Union. The threat targets retail traders and crypto investors using popular browsers on Windows, and the newest samples indicate expansion to macOS.
Delivery mechanism and infection chain
According to the researchers, the JSCeal distribution campaign has been active since at least March 2024. The operators use malvertising — malicious ads on social networks impersonating nearly 50 cryptocurrency and trading brands, including TradingView. Victims are redirected to fake sites where they are prompted to download rogue installers.
Delivery is carried out via PowerShell, which downloads two ZIP archives:
- The first contains the Node.js runtime environment
- The second holds the main payload in
.jscformat (compiled V8 bytecode), auxiliary scripts, native Node.js modules, and utilities such as winpty-agent.exe
Splitting the runtime and the payload into separate archives is an intentional choice: legitimate Node.js does not typically trigger antivirus alerts, and compiled bytecode is significantly harder to analyze than regular JavaScript. The activity is linked to a threat cluster known as WEEVILPROXY and MeadowLocust, although name overlap by itself does not prove a single operator.
Multilayer obfuscation
JSCeal is protected using javascript-obfuscator, an open-source tool. The operators sequentially apply four groups of transformations:
- Identifier renaming — replacing function and variable names with meaningless short strings
- String encryption — critical strings are split into fragments, encoded, and protected with the RC4 algorithm, then reconstructed via decoder functions
- Control-flow flattening — program logic is transformed into a flat switch statement inside an infinite loop controlled by a state variable
- Proxy functions and operation wrappers — function calls are routed through intermediate helpers, and simple operations (addition, comparison) are wrapped in separate functions
These transformations are applied before compilation into V8 bytecode, creating a double barrier: the analyst faces both a version-dependent binary format and multiple layers of JavaScript obfuscation. As researcher Alexandra Donets (Hasherezade) noted, none of these barriers alone makes reverse engineering impossible, but together they push analysis beyond standard workflows.
To address this, Check Point developed a fully static deobfuscation pipeline that processes V8 pseudocode without executing the malware. The tool was successfully applied to all 23 JSCeal samples examined.
Malware capabilities
Browser data theft
The data-stealing module targets the following Chromium-based browsers:
- Google Chrome, Microsoft Edge, Brave
- Opera, Opera GX, Avast Secure Browser
- Vivaldi, Cốc Cốc
For each browser, the malware locates the user data directory, enumerates profiles, and extracts cookies, saved passwords, and OAuth tokens. Chromium v10, v11, and v20 encryption formats are supported.
Session replay and authentication bypass
JSCeal contains a Puppeteer-based workflow that launches the installed browser, injects stolen cookies, interacts with authentication pages, looks for the user_id and oauth_token cookies, and saves the resulting Google OAuth token. This enables session replay attacks for unauthorized access to Google accounts, although success depends on the current iteration of Google’s authentication mechanisms.
HTTPS traffic interception and modification
The malware sets up a local proxy server and generates its own certificate, injecting it into the system. The proxy is not limited to passive observation — the recovered code contains dedicated handlers for modifying requests and responses. The configuration function includes specific overrides for Binance, Bybit, and Ledger, as well as generic handlers for swapping HTML, blocking hosts, and clearing selected cookies. A separate cryptocurrency module collects account data and balances across numerous platforms, including OKX, Kraken, KuCoin, MEXC, and Gate.io.
Surveillance
Additional modules provide keystroke logging, screenshot capture, and theft of Telegram sessions.
Evolution and expanding reach
According to Check Point, the latest JSCeal samples show active development: an updated generation of the Node.js/V8 code cache, an additional payload encryption layer, and — most notably — the emergence of samples targeting macOS. This indicates an expansion of platform coverage beyond Windows.
Impact assessment
The primary risk group consists of retail traders and crypto investors who use Chromium-based browsers to access cryptocurrency exchanges. The combination of credential theft, traffic interception, and session replay creates conditions for the full compromise of cryptocurrency accounts with direct financial losses. The scale of the malvertising (around 35,000 ads over six months) points to an industrialized operation.
Security recommendations
- Download software only from official sources — do not install TradingView or other trading applications via links in social media ads
- Certificate checks — monitor for unknown root certificates appearing in the system and browser stores; their presence may indicate installation of an interception proxy
- PowerShell monitoring — configure logging and alerts for PowerShell commands that download ZIP archives from external servers
- Hardware security keys for authentication — use FIDO2/WebAuthn to protect Google accounts and crypto exchanges, neutralizing cookie-based session replay attacks
- Audit of extensions and Node.js processes — unexpected node.exe processes loading .jsc files from user directories are an indicator of compromise
- Token rotation — if compromise is suspected, immediately revoke Google OAuth tokens and reset sessions on all cryptocurrency platforms
JSCeal illustrates a trend in which malware authors invest in non-standard execution formats (compiled V8 bytecode instead of conventional executables) to evade traditional analysis tools. For organizations and individual traders, priority actions include migrating to hardware-based authentication for cryptocurrency services and Google accounts, as well as deploying monitoring for Node.js process launches in atypical contexts — these measures neutralize JSCeal’s key capabilities for session theft and traffic interception.
