Cybersecurity researchers have uncovered new details about JSCeal, a sophisticated malware built from compiled V8 JavaScript that can steal browser credentials, spy on victims, and intercept web traffic.
Check Point Research said the malware uses several layers of JavaScript obfuscation to make analysis difficult. Its code relies on encrypted strings, control-flow flattening, proxy functions, and helper wrappers that hide what the malware is actually doing.
JSCeal was first documented by Check Point in July 2025. The malware has been distributed through fake cryptocurrency trading websites promoted through malicious advertisements on platforms such as Facebook and Google. Victims are redirected to counterfeit trading sites and encouraged to download fake TradingView installers, which ultimately install the malware. The activity has been linked to threat clusters known as WEEVILPROXY and MeadowLocust.
The campaigns use two ZIP archives delivered through PowerShell. One contains the Node.js runtime, while the other carries JSCeal along with additional components needed to run the attack.
The malware activity also appears to overlap with a large malvertising campaign called SourTrade. Confiant recently reported that SourTrade has been impersonating cryptocurrency and trading brands including Solana, Luno, and TradingView. Instead of simply downloading a completed malware file, the campaign uses malicious JavaScript on fake websites to instruct the victim’s browser to assemble the malware directly in memory.
SourTrade has reportedly been active since late 2024 and has targeted retail traders and cryptocurrency investors across 12 countries and 25 languages, particularly in the Asia-Pacific and Latin American regions. Researchers have found evidence connecting the operation to a JSCeal campaign previously described by Bitdefender.
JSCeal uses javascript-obfuscator to hide its code in several ways. Function and variable names are replaced with meaningless identifiers, important strings are split into pieces and protected with RC4 encryption, and decoder functions rebuild them during execution. The malware also uses control-flow flattening, turning normal program logic into a complicated switch-based structure controlled by a loop and state variable.
The malware further hides its behavior by routing function calls through proxy helpers and wrapping basic operations such as addition, subtraction, comparisons, and function calls inside separate helper functions.
Check Point said it developed a static deobfuscation process capable of decoding the compiled V8 JavaScript bytecode and revealing the malware’s execution flow. The analysis showed that JSCeal can identify installed browsers and search them for stored passwords, cookies, OAuth tokens, and other sensitive information.
The browser-stealing component targets a wide range of Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Avast Secure Browser, Vivaldi, and Cốc Cốc. JSCeal searches the expected user-data directories, identifies browser profiles, and extracts stored cookies and passwords.
The stolen cookies can also be used to recreate an active browser session. This gives attackers the ability to carry out session replay attacks and potentially access a victim’s Google account without needing to obtain the account password directly.
JSCeal also includes surveillance capabilities. Researchers found functionality for recording keystrokes and taking screenshots, allowing attackers to monitor activity on infected systems.
Another major component is designed to intercept and modify web traffic. Check Point found code for setting up a local proxy, generating and installing certificates, and modifying requests and responses for selected online services.
The proxy functionality includes specific configurations for cryptocurrency platforms such as Binance, Bybit, and Ledger. Other handlers can replace HTML content, block selected hosts, or remove specific cookies. Some cryptocurrency-focused functions can also collect account information and record cryptocurrency balances.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Researchers say JSCeal combines compiled V8 JavaScript with several layers of obfuscation, creating additional challenges for security analysts trying to reverse-engineer it. While these techniques do not make the malware impossible to analyze, they move it away from the standard workflows normally used to inspect JavaScript threats.
JSCeal Malware Targets Crypto Users With Browser Theft and Surveillance
