JSCeal Malware: Advanced V8-Bytecode Threat Targeting Cryptocurrency Users

JSCeal is a cryptocurrency-stealing infostealer that delivers compiled V8 bytecode (.jsc) executed by a bundled Node.js runtime. First observed in early 2025, it has been linked to malvertising campaigns impersonating platforms such as Solana, Luno and TradingView. Victims are redirected from malicious ads on Facebook and Google to look-alike portals that prompt a counterfeit installer, which runs a PowerShell script to fetch two ZIP archives—one with the Node.js runtime and the other the obfuscated payload.

JSCeal Infostealer Malware Bypasses Google Authentication and 2FA via Stolen Browser Session Cookies

Check Point Research documented the initial campaign in July 2025, noting overlap with threat clusters WEEVILPROXY and MeadowLocust. The operation, dubbed “SourTrade” by Confiant, targets retail traders and cryptocurrency investors across 12 countries and 25 languages, primarily in Asia-Pacific and Latin America. Newer variants were observed as recently as June 2026.

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

• Geographic reach: 12 countries, 25 languages.

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

• Browser coverage: extracts data from eight Chromium-based browsers.

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

• Encryption timeline: first sample with AES-256-CBC added on Nov 11 2025.

JSCeal Hides Crypto Malware in V8 Bytecode

• Distribution method: two ZIP archives delivered via PowerShell; one holds the Node.js runtime, the other the JSCeal payload.

JSCeal Infostealer Malware Bypasses Google Authentication and 2FA via Stolen Browser Session Cookies

Check Point says the payload uses the commercial javascript-obfuscator tool, applying RC4-protected strings, control-flow flattening, proxy functions and operation wrappers before compilation. The malware sets up a local HTTPS proxy, generates attacker-controlled certificates, and modifies traffic for services such as Binance, Bybit and Ledger. Confiant notes the “landing page” technique that delivers assembly instructions, causing the victim’s browser to build the malware entirely in memory.

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

JSCeal automates browser-session hijacking. By stealing cookies, OAuth tokens and other session artifacts, it can launch a victim’s browser, inject the stolen cookies via Puppeteer with stealth plugins, and navigate Google’s authentication flow, bypassing two-factor authentication. The local proxy enables in-the-middle attacks against cryptocurrency exchanges, allowing real-time alteration of QR codes, transaction details and verification prompts.

JSCeal Infostealer Malware Bypasses Google Authentication and 2FA via Stolen Browser Session Cookies JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies JSCeal Hides Crypto Malware in V8 Bytecode

• “The payloads are protected with javascript-obfuscator, using multiple techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers,” — Check Point Research

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

• “What makes SourTrade technically distinct is what happens on its landing page,” — Confiant

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

• “A common technique used by banking trojans is to install a local proxy and inject or modify web content in selected services,” — Check Point

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

Sources agree JSCeal uses compiled V8 bytecode and multiple obfuscation layers. Check Point emphasizes RC4-protected strings, Confiant focuses on the in-memory assembly technique, and Rescana stresses the AES-256-CBC encryption added in late 2025. The exact proportion of infections from each distribution vector remains unspecified.

JSCeal Infostealer Malware Bypasses Google Authentication and 2FA via Stolen Browser Session Cookies

Check Point’s deobfuscation pipeline, built on the open-source View8 decompiler, produced readable output for 23 samples collected over several months. The team continues to monitor newer variants that incorporate updated Node.js runtimes and encryption layers, indicating active development. Organizations handling cryptocurrency assets should watch for the described proxy and certificate-installation behaviors and enforce strict browser-session hygiene.

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies