JSCeal Crypto Stealer Uses V8 Bytecode to Steal Browser Credentials and Intercept HTTPS

A sophisticated cryptocurrency-focused information stealer that hides its malicious logic inside compiled V8 JavaScript bytecode.

JSCeal, also tracked by some vendors as WEEVILPROXY or MeadowLocust, is not delivered as readable JavaScript. Instead, operators package the final payload as a .jsc file compiled V8 bytecode executed with a bundled Node.js runtime.

This approach frustrates conventional JavaScript analysis because the original source code is absent, while many native reverse-engineering tools lack visibility into the malware’s high-level logic.

The infection chain previously associated with JSCeal begins with malvertising and a sequence of PowerShell stages.

The final stage downloads ZIP archives containing a hidden-console component, the Brotli-compressed app.jsc payload, a preflight.js decompression script, and native Node.js modules.

A PowerShell command then launches Node.js with the preload script before executing the compiled payload: node.exe -r preflight.js app.jsc.

The V8 bytecode layer is only one element of JSCeal’s defense-evasion strategy. Before compilation, the malware’s JavaScript is heavily protected with javascript-obfuscator.

Researchers observed RC4-encrypted and Base64-encoded string fragments, arithmetic index transformations, control-flow flattening, proxy function calls, and operation wrappers.

These layers hide critical strings, API calls, browser paths, command execution routines, and targeted services from analysts.

To break through the protection, Check Point researchers extended the open-source View8 V8-bytecode decompiler and developed a dedicated static deobfuscation pipeline.

The workflow reconstructs encrypted strings, resolves values passed through scopes and dictionaries, removes control-flow flattening, identifies proxy calls, and replaces obscured wrapper functions with their underlying operations.

CheckPoint Researchers said that, the malware combines browser credential theft, session hijacking, cryptocurrency-wallet targeting, keylogging, screen capture, and local HTTPS interception, creating a broad risk for users of financial services.

JSCeal Crypto Stealer

The researchers reported that their pipeline generated analyzable output for all 23 JSCeal payloads examined over several months.

In greedy mode, follows all visible function references, including callbacks, handlers, and functions assigned into objects. Greedy mode therefore covers a broader part of the program, but it also produces a much larger graph.

Once decoded, JSCeal’s browser-stealing capability becomes particularly concerning.

The malware enumerates installed browsers and extracts saved passwords, cookies, autofill data, browser profile information, and OAuth-related tokens.

Its code includes functions and strings associated with cookie extraction, browser launching, profile-directory access, Google account correlation, and saved-password collection.

This gives attackers access to reusable session material rather than merely static credentials.

The operational impact is substantial. Stolen cookies can enable session replay, while collected passwords and recovered Google-related data can help operators automate account-access workflows and acquire fresh OAuth tokens.

For cryptocurrency users, the malware also searches for wallet-related artifacts and platform data associated with services such as Binance and Phantom, enabling account reconnaissance and potential financial theft.

JSCeal also contains a local HTTPS interception feature. Recovered strings show the malware creating a server bound to 127.0.0.1, generating RSA key pairs and certificates, and deploying a local proxy.

By installing an attacker-controlled certificate, the malware can position itself to inspect or modify supposedly encrypted web traffic. This creates exposure beyond stored browser data, including credentials and transaction information entered during active sessions.

The malware’s wider surveillance toolkit includes Telegram session collection, host and installed-application discovery, keylogging, screenshot capture, and the ability to spawn additional processes.

The combination makes JSCeal closer to a modular account-takeover and financial-surveillance framework than a conventional browser-password stealer.

For defenders, JSCeal demonstrates why .jsc and bundled Node.js artifacts require closer scrutiny in endpoint telemetry and malware triage.

Security teams should investigate suspicious PowerShell-to-Node.js execution chains, Brotli-compressed bytecode payloads, unexpected local proxy listeners, certificate-store changes, and access to browser credential databases.

Check Point has released its JSCeal deobfuscation toolkit publicly, offering analysts a practical route to inspect this increasingly abused V8-bytecode malware format.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide