JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

Severity
Medium

Detail

Cybersecurity researchers have analyzed JSCeal, a sophisticated compiled V8 JavaScript malware capable of credential theft, surveillance, browser data collection, and web traffic interception. First documented by Check Point Research in July 2025, JSCeal has been distributed through malicious advertising campaigns that redirect victims to fake cryptocurrency trading websites impersonating legitimate services such as TradingView. Victims are then encouraged to download fake TradingView installers, which ultimately deploy the malware. The activity overlaps with threat clusters tracked as WEEVILPROXY and MeadowLocust.

JSCeal is protected using the JavaScript obfuscation tool javascript-obfuscator, with multiple layers of obfuscation designed to make analysis and reverse engineering more difficult. Check Point Research developed a fully static deobfuscation pipeline to recover the malware’s execution flow and identify its capabilities.

How?

JSCeal has been distributed through malvertising campaigns that use fake cryptocurrency trading websites and fraudulent installers. In some campaigns, two ZIP archives are delivered through PowerShell: one contains the Node.js runtime, while the other contains the main malware and supporting components.

The malware uses several obfuscation techniques, including renaming functions and variables with short or meaningless identifiers, splitting important strings into encoded and RC4-protected fragments, and reconstructing them through decoder functions. It also uses control-flow flattening, proxy functions, and dedicated operation wrappers to make the underlying code more difficult to understand.

Once executed, JSCeal can identify installed browsers and access their stored data. The malware targets numerous Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Avast Secure Browser, Vivaldi, and Cốc Cốc. It searches browser user-data directories and profiles to extract information such as saved passwords, cookies, OAuth tokens, and other stored secrets.

One of the most significant capabilities is its ability to use stolen browser cookies to reconstruct an authenticated browser session. This allows the operators to conduct session replay attacks and potentially bypass authentication mechanisms to gain unauthorized access to a victim’s Google account.

JSCeal also contains a surveillance component capable of recording keystrokes and taking screenshots. In addition, recovered code shows that the malware can establish a local proxy, generate and install certificates, and modify selected web traffic.

The proxy functionality includes handlers that can alter requests and responses for specific services. Dedicated configurations exist for cryptocurrency platforms including Binance, Bybit, and Ledger, alongside generic functions for replacing HTML content, blocking hosts, and clearing selected cookies.

The malware also contains cryptocurrency-focused handlers capable of collecting account information and recording cryptocurrency balances.

Impact

JSCeal presents a significant risk because stolen browser session cookies can potentially allow attackers to replay an authenticated session and access a victim’s Google account without relying solely on the victim’s password. The malware can also expose browser passwords, cookies, OAuth tokens, and other stored secrets. Its keylogging and screenshot capabilities provide additional opportunities for monitoring victim activity and collecting sensitive information.

Its local proxy capabilities further increase the risk by allowing attackers to intercept or modify web traffic and target specific cryptocurrency services. The malware’s ability to collect cryptocurrency account information and balances makes cryptocurrency users and investors an important target. The use of compiled V8 JavaScript together with multiple layers of obfuscation also increases the difficulty of analyzing and detecting the malware.

Conclusion

JSCeal demonstrates how malware authors are combining sophisticated obfuscation with browser data theft, session replay, surveillance, and traffic interception capabilities. Its ability to use stolen cookies to reconstruct authenticated sessions is particularly concerning because it can potentially bypass normal authentication protections and provide unauthorized access to Google accounts.

The continued development of JSCeal, together with its expanding browser and cryptocurrency-related capabilities, shows that the malware remains an active threat. Organizations and users should therefore focus on preventing malware delivery through malicious advertisements and fake software installers while monitoring endpoints and browser environments for suspicious credential, cookie, and session-related activity.

Source

https://thehackernews.com/2026/09/jsceal-malware-can-bypass-google.html