Full Report
Cybersecurity researchers have unpacked JSCeal, a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-interception capabilities. "The payloads are protected with javascript-obfuscator, using multiple techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers," Check Point Research said in a
Analysis Summary
# Tool/Technique: JSCeal
## Overview
JSCeal is a sophisticated information-stealing malware written in JavaScript and distributed as compiled V8 bytecode (JSC). It is primarily designed for credential harvesting, session hijacking, and surveillance. The malware is notable for its use of the Node.js runtime to execute payloads and its heavy reliance on advanced obfuscation to hinder static and dynamic analysis.
## Technical Details
- **Type:** Malware family (Infostealer / Spyware)
- **Platform:** Windows (utilizing Node.js runtime)
- **Capabilities:** Credential harvesting, cookie theft, session replay (MFA bypass), keylogging, screen capture, and traffic interception.
- **First Seen:** Detected by researchers in July 2025 (Active since late 2024).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1589.002 - Gather Victim Identity Information: Credentials
- T1204.002 - User Execution: Malicious File (Fake installers)
- **TA0002 - Execution**
- T1059.001 - Command and Scripting Interpreter: PowerShell
- T1204 - User Execution
- **TA0006 - Credential Access**
- T1539 - Steal Web Session Cookie
- T1555.003 - Credentials from Web Browsers
- **TA0007 - Discovery**
- T1012 - Query Registry
- T1083 - File and Directory Discovery
- **TA0009 - Collection**
- T1056.001 - Input Capture: Keylogging
- T1113 - Screen Capture
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information
- T1027.002 - Software Packing (V8 Bytecode compilation)
## Functionality
### Core Capabilities
- **Browser Data Extraction:** Targets Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi, etc.) to extract saved passwords, cookies, and OAuth tokens.
- **Session Replay Attacks:** Specifically leverages stolen cookies to reconstruct active browser sessions, allowing attackers to bypass Google authentication and MFA.
- **System Enumeration:** Lists installed browsers and locates user-data directories to identify specific profiles for targeting.
### Advanced Features
- **V8 Bytecode Compilation:** Payloads are delivered as compiled V8 bytecode rather than plain text JavaScript, making traditional signature-based detection difficult.
- **Heavy Obfuscation:** Uses `javascript-obfuscator` with RC4-protected strings, control-flow flattening, and proxy functions to hide its logic.
- **Surveillance Suite:** Includes modules for capturing real-time keystrokes and taking screenshots of the victim's desktop.
- **In-Memory Assembly (SourTrade Overlap):** Linked campaigns use "SourTrade" techniques where the browser assembles the final malware in memory using clean components to avoid network-based file detection.
## Indicators of Compromise
- **File Names:** `TradingView` (fake installers), Node.js runtime components.
- **Network Indicators:**
- `weevilproxy[.]com` (Defanged)
- `meadowlocust[.]net` (Defanged)
- Fake trading sites impersonating Solana, Luno, and TradingView.
- **Behavioral Indicators:**
- PowerShell scripts downloading two distinct ZIP archives.
- Unexpected Node.js execution on an endpoint.
- Access to `%AppData%\Local\Google\Chrome\User Data` by non-browser processes.
## Associated Threat Actors
- **WEEVILPROXY**
- **MeadowLocust**
- **SourTrade** (Campaign/Cluster name)
## Detection Methods
- **Signature-based detection:** Focus on detecting the specific `javascript-obfuscator` patterns and the Node.js loader script.
- **Behavioral detection:** Monitor for unauthorized access to browser credential stores and high-frequency screenshot/keylogging activity by Node.js processes.
- **Deobfuscation:** Use specialized tools (like the pipeline developed by Check Point/hasherezade) to decompile V8 bytecode for analysis.
## Mitigation Strategies
- **Application Whitelisting:** Restrict the execution of Node.js or unknown binaries in user-writable directories (e.g., `%AppData%`).
- **Web Filtering:** Block access to known malicious ad domains and lookalike cryptocurrency/trading websites.
- **Session Security:** Implement Short-lived sessions and Token Binding to mitigate the impact of stolen session cookies.
- **User Education:** Train users to download software only from official sources (e.g., direct from TradingView) rather than via social media ads.
## Related Tools/Techniques
- **javascript-obfuscator:** The primary tool used for protecting the malicious payloads.
- **SourTrade:** A delivery framework that assembles malware in-memory.
- **Banking Trojans:** Shared techniques involving local proxies and web content injection.