JSCeal Crypto Stealer Uses V8 Bytecode to Steal Browser Credentials and Intercept HTTPS

A sophisticated cryptocurrency-focused information stealer that hides its malicious logic inside compiled V8 JavaScript bytecode.

JSCeal, also tracked by some vendors as WEEVILPROXY or MeadowLocust, is not delivered as readable JavaScript. Instead, operators package the final payload as a .jsc file compiled V8 bytecode executed with a bundled Node.js runtime.

This approach frustrates conventional JavaScript analysis because the original source code is absent, while many native reverse-engineering tools lack visibility into the malware’s high-level logic.

The infection chain previously associated with JSCeal begins with malvertising and a sequence of PowerShell stages.

The final stage downloads ZIP archives containing a hidden-console component, the Brotli-compressed app.jsc payload, a preflight.js decompression script, and native Node.js modules.

A PowerShell command then launches Node.js with the preload script before executing the compiled payload: node.exe -r preflight.js app.jsc.

The V8 bytecode layer is only one element of JSCeal’s defense-evasion strategy. Before compilation, the malware’s JavaScript is heavily protected with javascript-obfuscator.

Researchers observed RC4-encrypted and Base64-encoded string fragments, arithmetic index transformations, control-flow flattening, proxy function calls, and operation wrappers.

These layers hide critical strings, API calls, browser paths, command execution routines, and targeted services from analysts.

To break through the protection, Check Point researchers extended the open-source View8 V8-bytecode decompiler and developed a dedicated static deobfuscation pipeline.

The workflow reconstructs encrypted strings, resolves values passed through scopes and dictionaries, removes control-flow flattening, identifies proxy calls, and replaces obscured wrapper functions with their underlying operations.

CheckPoint Researchers said that, the malware combines browser credential theft, session hijacking, cryptocurrency-wallet targeting, keylogging, screen capture, and local HTTPS interception, creating a broad risk for users of financial services.

JSCeal Crypto Stealer

The researchers reported that their pipeline generated analyzable output for all 23 JSCeal payloads examined over several months.

In greedy mode, follows all visible function references, including callbacks, handlers, and functions assigned into objects. Greedy mode therefore covers a broader part of the program, but it also produces a much larger graph.

Once decoded, JSCeal’s browser-stealing capability becomes particularly concerning.

The malware enumerates installed browsers and extracts saved passwords, cookies, autofill data, browser profile information, and OAuth-related tokens.

Its code includes functions and strings associated with cookie extraction, browser launching, profile-directory access, Google account correlation, and saved-password collection.

This gives attackers access to reusable session material rather than merely static credentials.

The operational impact is substantial. Stolen cookies can enable session replay, while collected passwords and recovered Google-related data can help operators automate account-access workflows and acquire fresh OAuth tokens.

For cryptocurrency users, the malware also searches for wallet-related artifacts and platform data associated with services such as Binance and Phantom, enabling account reconnaissance and potential financial theft.

JSCeal also contains a local HTTPS interception feature. Recovered strings show the malware creating a server bound to 127.0.0.1, generating RSA key pairs and certificates, and deploying a local proxy.

By installing an attacker-controlled certificate, the malware can position itself to inspect or modify supposedly encrypted web traffic. This creates exposure beyond stored browser data, including credentials and transaction information entered during active sessions.

The malware’s wider surveillance toolkit includes Telegram session collection, host and installed-application discovery, keylogging, screenshot capture, and the ability to spawn additional processes.

The combination makes JSCeal closer to a modular account-takeover and financial-surveillance framework than a conventional browser-password stealer.

For defenders, JSCeal demonstrates why .jsc and bundled Node.js artifacts require closer scrutiny in endpoint telemetry and malware triage.

Security teams should investigate suspicious PowerShell-to-Node.js execution chains, Brotli-compressed bytecode payloads, unexpected local proxy listeners, certificate-store changes, and access to browser credential databases.

Check Point has released its JSCeal deobfuscation toolkit publicly, offering analysts a practical route to inspect this increasingly abused V8-bytecode malware format.

IOCs

md5 (JSC original)	md5 (unpacked)	sha256 (unpacked)
(unknown)	91038aebe528a065c3e995a418db6826	c288e79ed9d1fb654a341b92d878a3165a09fb21dfa826f3559b46738fdbbdeb
03f4e47b9c2283c32bb8f8f042ce6e41	13823095b8d31013ba41a5c98ce69b59	8b3ed808822479eb62d78d819db35362e4e79138ac82310d30e0c351a17992b6
0b8015cbb1ffdc6efe6a306ff5b1115f	454fb012cdd0736e4ed41fabf0916f46	2cf2d22d1317df6c49171be61ef35c4f6c3da17785fa73e68aa95109075f79bd
1026743185dfa10e9ddc21b5a4c578d5	975319142460fc43e3dc5e495d2313c9	94191824bb5062622663e2434d2b749a8c936eb573aaac23594dee8dda304731
201f28b5e62e52e269757930f941c774	09dbfac09f9cafdbc7d225eb144f0e69	742ad2dd3d2444bd3758b6e46dd76f9c43dfaae03bdffc3598ce7d8ab3cd3ac5

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide