A Compiled JavaScript Threat That Bypasses MFA
Security researchers have unpacked JSCeal, a sophisticated malware family built as compiled V8 JavaScript (JSC) with credential harvesting, surveillance, and traffic-interception capabilities. Rather than stealing passwords outright, JSCeal's headline trick is session replay: it steals live browser session cookies and reuses them to impersonate victims on Google accounts — sidestepping passwords and MFA prompts entirely, since the session already looks authenticated to Google's servers.
The payloads are protected with javascript-obfuscator, layering RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers to frustrate static analysis and evade detection.
How It Works
Credential and Cookie Theft
JSCeal navigates directly into the user-data directories of Chromium-based browsers — Chrome, Edge, Brave, Opera, Vivaldi, and others — to extract stored cookies and saved passwords from every available browser profile.
Session Replay Against Google
With valid session cookies in hand, JSCeal conducts active session replay attacks, presenting the stolen session to Google as if it belongs to a legitimate, already-authenticated device. This grants attackers unauthorized access to a victim's Google account without ever needing the account password.
Beyond Credential Theft
JSCeal's capabilities extend well past cookie theft:
| Capability | Description |
|---|---|
| Keystroke logging | Captures typed input across the system |
| Screenshot capture | Periodic screen grabs for surveillance |
| Local proxy installation | Intercepts and modifies traffic in transit |
| Certificate generation/installation | Enables TLS interception on the victim's machine |
| Crypto exchange tampering | Modifies requests/responses for Binance, Bybit, and Ledger |
| Balance tracking | Captures account data and cryptocurrency balances |
Delivery: Fake Crypto Trading Platforms
JSCeal spreads through malvertising campaigns built around counterfeit cryptocurrency trading sites. Victims are lured in via:
- Fake Facebook and Google ads
- Bogus TradingView installer downloads
- Malicious ZIP archives delivered via PowerShell, bundling a Node.js runtime alongside the malicious payload components
Researchers note overlap between JSCeal campaigns and the threat clusters tracked as WEEVILPROXY and MeadowLocust, with victims impersonated through fake Solana, Luno, and TradingView branding.
Who's Being Targeted
- Retail traders and cryptocurrency investors are the primary targets.
- Campaigns have been observed across 12 countries and 25 languages, concentrated in the Asia-Pacific and Latin America regions.
- Any user of a targeted Chromium-based browser is a potential victim, regardless of whether they interact with cryptocurrency directly, since Google account takeover has broad downstream value.
Protective Measures
- Don't trust trading-platform ads — download tools like TradingView directly from the official site, never via search or social ads.
- Verify installer sources before running anything distributed as a ZIP from an ad-driven download page.
- Use hardware security keys (FIDO2/WebAuthn) for Google account protection — passkeys and hardware keys are far more resistant to session-replay style attacks than app-based MFA alone.
- Monitor for unexpected active sessions in your Google Account's security activity, and revoke unrecognized sessions immediately.
- Run endpoint protection capable of detecting obfuscated V8/JSC payloads and unusual local proxy or certificate installation activity.
- Segregate crypto activity onto a hardened, dedicated device where possible, given the malware's specific targeting of exchange traffic.