JSCeal: Crypto Malware Hijacks Google Sessions and Spoofs Exchange Traffic

Check Point Research has published a technical breakdown of JSCeal — a piece of malware written in JavaScript and compiled to V8 engine bytecode (the JSC format). It was first reported back in July 2025, and the latest report shows that its developers are still actively refining it.

How the victim gets the malware

Distribution runs through malicious ads on Facebook and Google. Users are lured to fake cryptocurrency exchange sites that offer them a bogus TradingView installer to download. According to the researchers, the campaign has been active since late 2024 and reaches retail traders and investors across 12 countries in 25 languages — chiefly in the Asia-Pacific region and Latin America.

The Confiant platform has described a related operation dubbed SourTrade, whose technical twist is that the finished malware never appears on the network in its entirety. The decoy page hands the browser only “build instructions,” pulls a clean, legitimate file from a third-party server, and assembles the malware right in the victim's machine memory.

Layers of anti-analysis protection

The payload is protected with the javascript-obfuscator utility. The authors apply several techniques at once: strings are encrypted with the RC4 algorithm and recovered by decoder functions, variable names are replaced with meaningless identifiers, and the program's logic is “flattened” into a single infinite loop with a state switch. Function calls go through proxy wrappers, and even the simplest operations, like addition, are hidden away in separate helper functions. The combination of compiled V8 bytecode and obfuscation, according to researcher Aleksandra “Hasherezade” Doniec, does not make analysis impossible, but it does push the malware beyond the reach of analysts' usual tools. Check Point responded with a static deobfuscator of its own.

What JSCeal can do

The data-theft module targets a long list of Chromium-based browsers — Chrome, Edge, Brave, Opera, Vivaldi, the Vietnamese Cốc Cốc, and others. From their profiles it extracts passwords, cookies, and OAuth tokens. On top of that, the malware can use stolen cookies to restore a browser session and, by replaying it, bypass authentication to gain access to a Google account without a password. There is also a surveillance module — keystroke logging and screenshots.

Following the example of banking Trojans, JSCeal spins up a local proxy, generates and installs a certificate, and substitutes the content of specific services. The code contained dedicated handlers for Binance, Bybit, and Ledger, as well as functions for intercepting account data and recording cryptocurrency balances. Given that the campaigns have continued in recent months, JSCeal remains under active development.

Source: The Hacker News