JSCeal Expands Beyond Stolen Google Sessions

For months, security analysts have been tracing a piece of malware that hides inside what looks like a routine cryptocurrency trading website. The payload, known as JSCeal, is no ordinary credential stealer. Recent research reveals it can take over a victim's Google account by replaying a stolen browser session — bypassing the login process entirely.

That finding comes as no surprise to those who have been following the malware's evolution. JSCeal was first documented by Check Point in July 2025, when attackers were using fake cryptocurrency trading sites accessed through malicious ads on Facebook and Google. The sites pushed counterfeit installers for TradingView, which dropped the malware onto victims' machines.

Deobfuscating a Packed V8 Payload

The core of JSCeal is protected using javascript-obfuscator, a tool that wraps code in layers of obfuscation. According to Check Point Research, the threats actors use multiple techniques, including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers.

To decode the compiled V8 JavaScript bytecode, Check Point said it developed a "fully static deobfuscation pipeline." That pipeline helped uncover details about the malware's execution flow and its features, including the ability to enumerate installed browsers and query saved secrets, cookies, and OAuth tokens.

JSCeal's obfuscation goes beyond simple string encoding. The operators repeatedly use four groups of transformations: replacing function and variable names with short or nonsensical identifiers; splitting important strings into chunks that are subsequently encoded and RC4-protected; using control-flow flattening to turn program flow into a flat, single-level switch statement; and forwarding function calls through proxy helpers that wrap simple operations like addition or subtraction.

Browser Stealing Under the Hood

The malware's browser-stealing module targets a long list of Chromium-based browsers. The list includes Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Avast Secure Browser, Vivaldi, and Cốc Cốc. For each browser, the malware navigates to the expected location of its user-data directory and lists available profiles, from where cookies and passwords are extracted.

What makes JSCeal particularly dangerous is its ability to use those stolen cookies to reconstruct a browser session. This allows for active session replay attacks to bypass authentication and gain unauthorized access to a victim's Google account. In other words, the attacker doesn't need the password — they just need the session tokens.

The malware also embeds a second module for surveillance. That module records keystrokes and takes screenshots, giving attackers a way to spy on victims in real time.

Proxy in the Middle

JSCeal doesn't stop at passive collection. Check Point researchers found that the recovered code shows proxy setup, certificate generation and installation, and service-specific request and response modification. This is a common technique used by banking trojans — installing a local proxy to inject or modify web content in selected services.

The proxy goes beyond passive interception. The recovered code contains dedicated handlers that modify selected requests and responses for specific services. A configuration function exposes separate overrides for Binance, Bybit, and Ledger, as well as generic handlers for replacing HTML, blocking hosts, and clearing selected cookies.

There also exist multiple handlers specifically focused on cryptocurrency platforms. One of these captures account data and records cryptocurrency balances. This suggests the attackers are primarily interested in digital currency.

From Phony Pages to Browser Assembly

JSCeal's distribution has evolved as well. The malvertising campaigns distributing the malware make use of two ZIP archives delivered via PowerShell. One archive contains the Node.js runtime, while the other contains the main payload and auxiliary components.

Ad security platform Confiant recently disclosed details of a massive malvertising operation codenamed SourTrade. That campaign impersonates trusted trading and cryptocurrency brands such as Solana, Luno, and TradingView to serve lookalike portals with malicious JavaScript. The JavaScript instructs web browsers to assemble malware directly in memory.

"What makes SourTrade technically distinct is what happens on its landing page," Confiant said. "It does not distribute finished malware. Instead, it delivers assembly instructions to the victim's browser, retrieves a clean legitimate file from separate infrastructure, and directs the browser to build the final malware in memory on the victim’s machine. No finished malware ever exists on the network."

That campaign is assessed to be active since late 2024, targeting retail traders and cryptocurrency investors across 12 countries in 25 languages, primarily in Asia Pacific and Latin America. Evidence indicates the campaign overlaps with a JSCeal campaign described by Bitdefender in September 2025.

A Multilayered Defense Against Analysis

JSCeal is built to be hard to analyze. The malware combines a version-specific compiled V8 format with several layers of JavaScript obfuscation applied before compilation. According to Aleksandra "Hasherezade" Doniec, a security researcher, those techniques don't make the malware impossible to reverse, but they do push it outside the workflows that analysts normally rely on.

"JSCeal combines two forms of analysis friction: a version-specific compiled V8 format and several layers of JavaScript obfuscation applied before compilation. Neither makes the malware impossible to reverse, but together they move it outside the workflows that analysts normally rely on."

— Aleksandra "Hasherezade" Doniec, security researcher

Doniec also noted that the JSCeal authors are investing in making the payload harder to analyze and in broadening its platform coverage. With campaigns continuing into recent months, the changes indicate JSCeal remains under active development.

Three-Front Evolution

Check Point's analysis shows JSCeal has evolved on three fronts: stealth, reach, and capability. The malware's authors have repeatedly updated its obfuscation, expanded the list of browsers it targets, and added new functions like session replay and proxy-based manipulation.

The shift toward session replay is particularly notable. It means that even if a victim changes their password or enables two-factor authentication, a stolen cookie could still allow an attacker to access their accounts. For Google accounts, this could be a serious risk, since a single sign-in can open the door to email, Drive, calendar, and more.

The malware's focus on cryptocurrency platforms adds another layer of risk for retail traders and investors. By overriding requests and responses for services like Binance, Bybit, and Ledger, JSCeal could manipulate balances or authorize transactions without the victim realizing it.

For everyday users, the advice is familiar: avoid clicking on ads for trading platforms, download software only from official sources, and be wary of any site that asks you to install a browser update or additional software. But given the sophistication of these campaigns, even cautious users may need to consider using dedicated browsers or virtual machines for high-value activities.

Why It Matters

JSCeal is not just another credential stealer. With its ability to bypass authentication by replaying sessions and to alter web traffic on the fly, it raises the stakes for anyone who uses their browser for sensitive transactions. The fact that it is still being actively developed suggests that these attacks will not stop soon.

For security teams, the challenge is that JSCeal does not follow the typical pattern of a banking trojan. It is a JavaScript-based threat that can operate across different platforms, making it harder to detect with traditional endpoint security. The malware's use of proxy-based content modification means that even encrypted traffic could be at risk if the victim trusts a malicious certificate.

As these campaigns continue into recent months, the growing sophistication of JSCeal could mean that more users will fall victim to these attacks. The key takeaway is that the threat landscape is shifting — not just toward more complex malware, but toward tools that are designed to survive the analysis process itself.