Cybersecurity researchers from Check Point Research have published a comprehensive technical teardown of JSCeal, a highly sophisticated malware written in compiled V8 JavaScript (JSC). The malware, which primarily targets retail cryptocurrency investors, has been observed bypassing Google’s multi-factor authentication (MFA) mechanisms by executing session replay attacks directly on infected host machines. This local execution represents a tactical shift from traditional credential harvesters, which typically exfiltrate stolen cookies to remote command-and-control servers before attempting authentication.
The Mechanics of Local Google Authentication Bypass
Traditional infostealers typically harvest browser cookies and transmit them to external infrastructure, where attackers attempt to use them. However, this often triggers security alerts due to sudden changes in IP addresses, geographic locations, and device fingerprints. JSCeal circumvents these defenses by processing the stolen data locally. According to Check Point’s recovered code, the malware navigates to the user-data directories of Chromium-based browsers—including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Avast Secure Browser, Vivaldi, and Cốc Cốc—to extract active session cookies and saved passwords.
Instead of immediately shipping these cookies to external servers, JSCeal replays the stolen cookies locally on the victim’s machine. It interacts directly with Google’s authentication endpoints from the infected system, thereby maintaining the trusted IP address and device context of the victim. This allows the malware to secure a fresh, legitimate OAuth token without triggering Google’s risk-based login protections. Once the OAuth token is acquired, the attackers gain persistent, unauthorized access to the victim’s Google account.
Malvertising Distribution and In-Memory Assembly
The distribution of JSCeal is tightly linked to a massive malvertising operation codenamed SourTrade, first disclosed by ad security platform Confiant. Active since late 2024, the campaign targets retail traders and cryptocurrency investors across 12 countries in 25 languages, primarily in the Asia Pacific and Latin America regions. The threat actors, operating under clusters known as WEEVILPROXY and MeadowLocust, use malicious ads on Facebook and Google to redirect users to counterfeit trading websites impersonating trusted brands like Solana, Luno, and TradingView.
What makes the SourTrade campaign technically distinct is its delivery mechanism. Rather than distributing a pre-compiled malicious executable, the landing page delivers raw assembly instructions directly to the victim’s browser. The browser is then instructed to retrieve a clean, legitimate file from separate infrastructure and assemble the final malware directly in the machine’s memory. Because no finished malware signature ever crosses the network, traditional network-level intrusion detection systems are bypassed. Once assembled, PowerShell scripts deliver the final payload, which includes a Node.js runtime and the compiled JSCeal components.
Obfuscation, V8 Bytecode, and Man-in-the-Middle Capabilities
JSCeal utilizes a dual layer of protection to frustrate automated analysis. The malware is written in compiled V8 JavaScript bytecode and is heavily obfuscated using the javascript-obfuscator utility prior to compilation. This involves replacing variable names with nonsensical identifiers, splitting and RC4-encrypting critical strings, flattening control flow into single-level switch statements, and routing simple operations through proxy helper functions.
To analyze the threat, Check Point developed a custom static deobfuscation pipeline capable of decoding the compiled V8 bytecode. This pipeline revealed that JSCeal also functions as a local man-in-the-middle (MitM) proxy. The malware installs a local proxy on the infected machine, generates and installs self-signed certificates, and actively intercepts encrypted HTTPS traffic. Specialized handlers within the malware target specific cryptocurrency platforms, including Binance, Bybit, and Ledger. These handlers can modify web content, inject malicious HTML, block specific hosts, and clear session cookies, allowing the threat actors to manipulate live transactions and siphon cryptocurrency balances directly from the browser.
Mitigation and Defensive Strategies
Security researcher Aleksandra “Hasherezade” Doniec noted that the combination of compiled V8 bytecode and multi-layer obfuscation successfully moves JSCeal outside the automated workflows that security analysts normally rely on. The ongoing activity of this campaign indicates that the malware authors are actively expanding its capabilities and platform coverage.
To defend against JSCeal, organizations and individual investors should implement robust endpoint detection and response (EDR) solutions capable of monitoring unauthorized PowerShell activity and unexpected Node.js execution. Furthermore, relying solely on standard session cookies for authentication remains a risk; users are encouraged to employ hardware-based security keys (FIDO2/WebAuthn) and regularly terminate active browser sessions to invalidate potentially compromised cookies.