JSCeal drives the victim's own browser to take over their Google account
Check Point's deobfuscation of 23 compiled V8 bytecode samples shows JSCeal replaying stolen cookies inside the victim's own browser profile, then stuffing local credentials at any password prompt until it holds a fresh OAuth token.
The Watch · Security desk
What happened
- Check Point Research presented its JSCeal teardown at Black Hat USA 2026, having tracked the cryptocurrency stealer since early 2025 and built tooling to read code it ships as compiled V8 bytecode.
- Delivery runs through malicious ads on Facebook and Google to counterfeit crypto trading sites, which push bogus TradingView installers as the route to the malware.
- Beyond harvesting passwords and cookies from eight Chromium browsers, JSCeal takes Telegram session data, logs keystrokes, grabs screenshots, and installs its own certificate to modify HTTPS traffic.
- Confiant's SourTrade operation has impersonated brands including Solana, Luno and TradingView since late 2024, hitting retail traders in 12 countries across 25 languages, mostly in Asia Pacific and Latin America.
Why it matters
- What's now possible capability Replaying the session from the victim's own machine and profile means the sign-in carries the device the account normally uses, so detection logic keyed to unfamiliar hardware or geography has nothing unusual to score.
- Who has to decide decision Containment after a crypto-adjacent infection has to reach sessions and OAuth grants, because rotating the password only addresses the credential the operator already used to mint the token.
- Who's exposed exposure One employee following a trading ad on a machine that holds a Chromium profile and a Telegram session puts any corporate account signed into that profile inside the harvest.
- What it costs cost The double obfuscation moves cost onto the defender side: off-the-shelf parts on the attacker's, a bespoke decompiler pipeline on Check Point's before anyone could describe the behaviour at all.
Next story · Invest · 4d ago
Bybit lets eligible global users buy over 1,000 US stocks with USDC, held in custody by AlpacaConfirmed2 publishers
Cookies come out of each Chromium profile's user-data directory, one profile at a time [4]. They go back into a browser the malware starts on the same host, and the automation is written to avoid looking like a bot while it walks Google's own authentication flow [7]. If Google asks for a password, the malware tries every credential it already lifted from that machine until one is accepted, and the run ends with a fresh, valid OAuth token [8]. Check Point describes the same behaviour as active session replay to gain unauthorized access to a victim's Google account [9].
Check Point's recovered flow describes a password prompt and credential stuffing, with no second factor challenged [8]. The published evidence supports authentication bypass by session replay [9], and the artifact left behind is a token [8]. Whether MFA was enforced on the targeted accounts, and beaten, is not something the evidence establishes either way. Credential rotation that does not also revoke sessions and third-party grants leaves that access standing.
The naming needs care. JSCeal, WEEVILPROXY and MeadowLocust are one thing under three vendor labels [1], and Confiant's SourTrade overlaps a JSCeal campaign Bitdefender wrote up in September 2025 [17]. Four labels sit on one cluster [19], the work of one operation rather than four crews independently arriving at cookie theft. Dated reporting places the same activity in 2024, 2025 and 2026 [20]. SourTrade's contribution is on the delivery side: according to Confiant, the landing page hands the browser assembly instructions, pulls a clean legitimate file from separate infrastructure, and has the browser build the payload in memory, so no finished malware ever exists on the network [18].
The service-specific handlers are where money moves. A configuration function exposes separate overrides for Binance, Bybit and Ledger, plus generic handlers for replacing HTML, blocking hosts and clearing cookies [6]. In practice that means the Binance login QR code swapped, a fake security challenge injected on Bybit, and Ledger's own scripts replaced with attacker-controlled content [5].
The analysis cost is lopsided. Two obfuscation layers, both assembled from existing open-source components, were cheap to produce and expensive to unwind, per the Security Affairs account of the report [12]. The answer was a purpose-built pipeline on top of the open-source View8 decompiler, which recovered readable code from 23 of 23 samples, a 100 percent hit rate [10][21]. Two things in this chain remain cheap to hunt for on a host: an attacker-generated certificate in the local trust store [3], and a Node.js runtime unzipped by PowerShell into a user directory [16]. Both land before the token does.
What to watch
- Whether any vendor documents an MFA or passkey challenge inside the JSCeal Google flow, which would change how much of the takeover session revocation actually stops.
- Whether Confiant's SourTrade infrastructure keeps being tied to the JSCeal cluster or splits off as a separate crew reusing the in-memory build technique.
- Whether Check Point releases the View8-based pipeline, which would raise the cost of shipping malware as compiled .jsc bytecode.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+18
- Incentives45
- Confidence63
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
JSCeal is a stealer delivered as compiled V8 bytecode (.jsc) and executed by a bundled Node.js runtime, targeting cryptocurrency applications; other vendors tag it WEEVILPROXY or MeadowLocust.
- [2]
Check Point first documented JSCeal in July 2025, describing fake cryptocurrency trading sites reached via malicious ads on Facebook and Google that instruct users to download bogus TradingView installers.
- [3]
JSCeal steals saved passwords and cookies from eight Chromium-based browsers, harvests Telegram session data, logs keystrokes, takes screenshots, and installs a locally generated attacker-controlled certificate to intercept and modify HTTPS traffic in transit.
- [4]
The browser stealing module targets Chrome, Edge, Brave, Opera, Opera GX, Avast Secure Browser, Vivaldi and Coc Coc; for each it navigates to the expected user-data directory, lists available profiles, and extracts cookies and passwords.
- [5]
The HTTPS interception capability lets JSCeal rewrite what a victim sees from real financial platforms, swapping login QR codes on Binance, injecting fake security challenges on Bybit, and replacing legitimate scripts served by Ledger's own website with attacker-controlled content.
- [6]
Check Point: a configuration function exposes separate overrides for Binance, Bybit and Ledger, as well as generic handlers for replacing HTML, blocking hosts and clearing selected cookies.
- [7]
The malware can launch a victim's own installed browser, inject stolen session cookies, and navigate through Google's actual account authentication flow using automation tooling built specifically to avoid looking like a bot.
- [8]
When the flow hits a password prompt, JSCeal tries every credential it previously stole from that same machine until one works, then obtains a fresh, valid OAuth token.
- [9]
Check Point says JSCeal reconstructs a browser session from stolen cookie data and conducts active session replay attacks to bypass authentication and gain unauthorized access to a victim's Google account.
- [10]
Check Point built on View8, an existing open-source V8 bytecode decompiler, extending it with a purpose-built pipeline tuned to JSCeal's patterns; applied across 23 JSCeal samples collected over several months, it produced usable, readable output in every case.
- [11]
JSCeal payloads are protected with javascript-obfuscator using RC4-protected strings, control-flow flattening, proxy functions and operation wrappers, and are then compiled into V8 bytecode.
- [12]
Stacking two separate obfuscation techniques produced a payload expensive to analyze but cheap for the attacker to produce, because none of the tools are custom-built and are assembled from existing open-source components.
- [13]
Ad security platform Confiant disclosed a malvertising operation codenamed SourTrade, impersonating trading and cryptocurrency brands including Solana, Luno and TradingView to serve lookalike portals with malicious JavaScript.
- [14]
SourTrade is assessed to be active since late 2024, targeting retail traders and cryptocurrency investors across 12 countries in 25 languages, primarily in Asia Pacific and Latin America.
- [15]
Check Point Research has tracked JSCeal since early 2025 and presented its latest research at Black Hat USA 2026, including a tool that converts the hidden code into a form analysts can read.
- [16]
Malvertising campaigns distributing JSCeal use two ZIP archives delivered via PowerShell: one containing the Node.js runtime and one containing the main payload and auxiliary components.
- [17]
Evidence indicates the SourTrade campaign overlaps with a JSCeal campaign described by Bitdefender in September 2025.
- [18]
Confiant: the SourTrade landing page does not distribute finished malware but delivers assembly instructions to the browser, retrieves a clean legitimate file from separate infrastructure, and directs the browser to build the final malware in memory, so no finished malware ever exists on the network.
- [19]
At least four labels are attached to the same overlapping activity: JSCeal, WEEVILPROXY, MeadowLocust and SourTrade.
- [20]
Dated vendor reporting places the same overlapping activity in three consecutive calendar years: 2024, 2025 and 2026.
- [21]
Check Point's deobfuscation pipeline recovered readable output from 23 of 23 samples, a 100 percent success rate.
Sources
2 independent publishers whose own reporting we read for this story.
- securityaffairs.comJSCeal Hides Crypto Malware in V8 Bytecode
1 article · September 7, 2026
- thehackernews.comJSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies
2 articles · September 7, 2026
Topics and entities
Topics
Entities
- Check Point Research
- Node.js
- Bybit
- V8
- javascript-obfuscator
- Ledger
- Aleksandra Doniec
- Black Hat USA
- Binance
- Bitdefender
- TradingView