Malware compiled to V8 JavaScript bytecode slips past the workflows most analysts rely on, and JSCeal leans into that gap. Check Point Research built a fully static deobfuscation pipeline that decodes the obfuscator-protected bytecode and pulled out the family’s full bag of tricks.
JSCeal arrives through fake trading portals, typically bogus TradingView installers pushed by malicious Facebook and Google ads, with delivery split across two ZIP archives, one holding the Node.js runtime. First seen in July 2025, the operation overlaps clusters called WEEVILPROXY and MeadowLocust, and campaigns have continued into recent months.
On an infected box the malware inventories Chromium-derived browsers, from Chrome and Edge to Brave, Opera, Vivaldi, and Avast Secure Browser, then walks each profile directory for cookies and saved passwords. Stolen cookies feed session replay attacks that slip past Google authentication, and an extra module logs keystrokes and captures screenshots.
JSCeal also runs a local proxy with its own generated certificate, letting it rewrite traffic for chosen services. Handlers recovered from the bytecode target Binance, Bybit, and Ledger, while generic ones swap HTML, block hosts, and clear cookies, and a dedicated routine records account data and cryptocurrency balances.
Obfuscation comes in four flavors: mangled identifiers, strings split and RC4-encrypted, control-flow flattening, and proxy functions wrapping basic operations, all layered on a version-specific compiled V8 format. That combination, Check Point notes, moves the malware outside standard tooling, and steady updates point to active development. Teams should treat saved browser sessions as credential material and stay alert to trading and crypto malvertising.
