Cybersecurity researchers have uncovered new details about JSCeal, a sophisticated malware family capable of stealing browser credentials, monitoring victims and intercepting web traffic. One of its most dangerous capabilities allows attackers to reconstruct active browser sessions using stolen cookies, potentially giving them access to Google accounts without going through the normal authentication process.
JSCeal was first documented by Check Point Research in July 2025 and has been distributed through malicious advertising campaigns involving fake cryptocurrency and trading websites. Victims are redirected through ads on platforms such as Google and Facebook to counterfeit sites that impersonate services like TradingView and encourage them to download malicious installers. The activity has been associated with threat clusters tracked as WEEVILPROXY and MeadowLocust.
The malware is written as compiled V8 JavaScript and uses several layers of obfuscation designed to make reverse engineering more difficult. Its developers use techniques including RC4-protected strings, control-flow flattening, proxy functions and wrappers around basic operations, creating additional work for researchers attempting to understand the malware’s internal behavior.
Check Point researchers developed a static deobfuscation pipeline capable of analyzing the compiled V8 JavaScript bytecode. This provided greater visibility into JSCeal’s architecture and revealed modules dedicated to browser credential theft, surveillance and manipulation of traffic associated with cryptocurrency services.
The browser-stealing component targets a wide range of Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Avast Secure Browser, Vivaldi and Cốc Cốc. JSCeal locates each browser’s user-data directory, enumerates available profiles and extracts information such as stored passwords and cookies.
Cookie theft is particularly dangerous because authentication does not end when a user successfully enters a password and completes multi-factor authentication. After login, websites typically create a session and issue cookies that allow the browser to remain authenticated without requiring the user to repeat the entire login process for every request.
JSCeal can take advantage of this mechanism by reconstructing browser sessions from stolen cookie data. Check Point found that the malware can conduct active session-replay attacks against Google accounts, allowing attackers to reuse authenticated session information and potentially gain unauthorized access without having to directly defeat the victim’s password or authentication challenge.
This makes session theft especially relevant in environments protected by multi-factor authentication. MFA can significantly reduce the effectiveness of stolen passwords, but an attacker who obtains a valid authenticated session may be able to bypass the point in the workflow where MFA would normally be requested.
JSCeal goes considerably further than browser credential theft. Another module provides surveillance capabilities by recording keystrokes and capturing screenshots, giving operators visibility into what victims type and what appears on their screens.
The malware can also install a local proxy and generate certificates that allow it to intercept and modify web traffic. This resembles techniques historically associated with banking trojans, which position themselves between the browser and targeted financial services so they can inspect or manipulate information while the victim interacts with legitimate websites.
JSCeal contains dedicated handlers for several cryptocurrency-related services, including Binance, Bybit and Ledger. Researchers found functionality capable of modifying selected requests and responses, replacing HTML content, blocking hosts and clearing specific cookies, demonstrating that the proxy is designed for active manipulation rather than simple passive surveillance.
Some handlers specifically capture cryptocurrency account information and balances. This focus corresponds with the malware’s distribution strategy, which deliberately targets people interested in trading and digital assets through fake investment and cryptocurrency websites.
Related malvertising activity has also demonstrated increasingly sophisticated delivery techniques. A campaign tracked as SourTrade has impersonated brands including Solana, Luno and TradingView while targeting retail traders and cryptocurrency investors across 12 countries and 25 languages, particularly in Asia-Pacific and Latin America. Researchers have identified overlaps between this activity and previously documented JSCeal campaigns.
One particularly unusual technique used in SourTrade avoids transmitting a finished malicious executable over the network. Instead, the landing page provides instructions that cause the victim’s browser to retrieve a legitimate file from separate infrastructure and assemble the final malware directly in memory. As a result, the completed malicious payload never travels across the network in its final form.
This approach can make conventional detection more difficult because security systems monitoring downloads may never observe the exact executable that ultimately runs on the machine. Combined with obfuscated JavaScript and legitimate runtime components, these techniques demonstrate how malware developers are increasingly attempting to break the assumptions used by traditional signature-based detection.
JSCeal’s use of compiled V8 JavaScript creates another challenge for malware analysts. Researchers must deal with both a version-specific compiled format and several layers of JavaScript obfuscation applied before compilation, pushing analysis outside many of the standard workflows normally used for investigating JavaScript-based malware.
The malware’s capabilities also highlight why browser data has become such a valuable target. Modern browsers contain far more than browsing history: they may hold passwords, authentication cookies, OAuth tokens and active sessions connected to email, cloud platforms, cryptocurrency services and corporate applications.
Protecting credentials therefore requires more than securing passwords. Organizations need to consider authenticated sessions as valuable security assets and monitor for unusual session reuse, unexpected locations, suspicious devices and other indicators suggesting that valid authentication material has been stolen.
For users, the infection chain reinforces the risks associated with downloading financial or cryptocurrency applications through advertisements and unfamiliar websites. Software such as TradingView should be obtained through trusted official sources rather than through sponsored search results or advertising links that can be manipulated by malicious operators.
JSCeal ultimately demonstrates how modern information stealers are evolving beyond simple password theft. By combining credential harvesting, session replay, screenshots, keylogging and active traffic interception, the malware gives attackers several independent ways to compromise a victim’s digital identity and financial activity.
The ability to replay Google sessions is particularly important because it illustrates a broader shift in identity attacks. As organizations strengthen password security and deploy MFA, attackers are increasingly targeting what happens after authentication, stealing the session itself rather than repeatedly trying to defeat the controls protecting the login process.