Cybersecurity researchers have dissected JSCeal, a sophisticated compiled V8 JavaScript malware capable of harvesting credentials, conducting surveillance, and intercepting web traffic while evading standard authentication protections. Check Point Research released a technical analysis last week detailing how the threat operates and the advanced obfuscation techniques shielding it from detection. The malware targets cryptocurrency traders and investors through fake trading platforms distributed via malicious advertisements on Facebook and Google.
The malware uses multiple layers of protection, including RC4-encrypted strings, control-flow flattening, proxy functions, and operation wrappers applied through javascript-obfuscator. Threat actors behind JSCeal create counterfeit cryptocurrency trading websites—impersonating brands like Solana, Luno, and TradingView—that distribute fake installers through PowerShell-delivered ZIP archives containing Node.js runtime and payload components. The campaign, tracked under the names WEEVILPROXY and MeadowLocust, has been active since late 2024 and operates across 12 countries in 25 languages, primarily targeting Asia Pacific and Latin America. JSCeal steals data from a long list of Chromium-based browsers including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Avast Secure Browser, Vivaldi, and Cốc Cốc by navigating to user-data directories and extracting cookies and passwords from all available profiles.
"JSCeal combines two forms of analysis friction: a version-specific compiled V8 format and several layers of JavaScript obfuscation applied before compilation," security researcher Aleksandra "Hasherezade" Doniec said in the report. Check Point developed a fully static deobfuscation pipeline to decode the compiled V8 JavaScript bytecode, revealing the malware's ability to enumerate installed browsers, query saved secrets and OAuth tokens, and register handlers for collected information. The malware also includes a surveillance module that records keystrokes and captures screenshots, while dedicated handlers modify requests and responses for cryptocurrency platforms like Binance, Bybit, and Ledger—capturing account data and recording cryptocurrency balances.
The malware's most dangerous capability lies in its session replay attacks: JSCeal uses stolen cookie data to reconstruct browser sessions and gain unauthorized access to victims' Google accounts without triggering authentication challenges. The threat follows patterns similar to banking trojans by installing a local proxy, generating and installing certificates, and modifying web content for selected services. According to the report, a configuration function exposes separate overrides for major cryptocurrency exchanges and generic handlers for replacing HTML, blocking hosts, and clearing selected cookies. The proxy doesn't just intercept passively—it actively modifies traffic flowing to and from cryptocurrency platforms.
The report concludes that JSCeal remains under active development, with recent campaigns showing the authors are investing in making the payload harder to analyze and expanding platform coverage. The combination of compiled V8 format and JavaScript obfuscation moves the malware outside workflows analysts normally rely on, making reverse engineering significantly more difficult. The ongoing evolution signals that threat actors see cryptocurrency traders as lucrative targets worth sustained technical investment. Organizations and individuals in the cryptocurrency space should treat browser security and authentication protections as perpetually vulnerable layers rather than hardened defenses, especially as adversaries continue refining tools that weaponize the browser itself against the user.