JSCeal Malware Steals Session Cookies to Bypass Google Authentication
New V8 JavaScript malware named JSCeal employs sophisticated obfuscation techniques to steal session cookies, enabling it to bypass Google authentication and conduct surveillance.
Cybersecurity researchers have detailed JSCeal, a potent V8 JavaScript (JSC) malware capable of harvesting credentials, performing surveillance, and intercepting network traffic. The malware's payloads are heavily protected using advanced obfuscation methods, including RC4 encryption for strings and control-flow flattening, making reverse-engineering a significant challenge.
First documented in July 2025, JSCeal has been observed being distributed through malvertising campaigns. Threat actors lure unsuspecting users to fake cryptocurrency trading websites, often impersonating legitimate platforms like TradingView. These counterfeit sites then prompt users to download malicious installers, which ultimately deploy the JSCeal malware. This distribution tactic aligns with threat clusters known as WEEVILPROXY and MeadowLocust.
The malvertising operations typically deliver the malware via PowerShell, using two ZIP archives: one containing the Node.js runtime and the other housing the main payload and supporting components. This method of in-memory assembly, as seen in the related SourTrade campaign, means no finished malware file necessarily exists on the victim's network, complicating detection.
JSCeal's obfuscation layers are extensive, involving multiple transformations. These include renaming functions and variables to obscure identifiers, splitting strings into encoded and RC4-protected chunks, and employing control-flow flattening to create a complex, single-level switch statement. Additionally, function calls are routed through proxy helpers, and basic operations are wrapped in dedicated helper functions, all designed to hinder analysis.
Researchers have developed a static deobfuscation pipeline to decode the compiled V8 JavaScript bytecode. This process reveals JSCeal's capabilities, such as enumerating installed browsers, querying saved secrets, cookies, and OAuth tokens, and utilizing "router" functions to manage collected information. The malware specifically targets a wide array of Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, and Opera, extracting cookies and passwords from their user-data directories.
A critical feature of JSCeal is its ability to leverage stolen session cookies for active session replay attacks. This allows the malware to bypass authentication mechanisms and gain unauthorized access to victim accounts, particularly Google accounts. Furthermore, JSCeal includes a surveillance module that can record keystrokes and capture screenshots, enhancing its espionage capabilities.
Beyond credential theft and surveillance, JSCeal incorporates a local proxy to intercept and modify web content for specific services. This includes dedicated handlers for cryptocurrency platforms like Binance and Bybit, as well as generic overrides for modifying HTML, blocking hosts, and clearing cookies. This functionality allows for targeted manipulation of financial transactions and sensitive data.
The ongoing development and sophisticated obfuscation techniques employed by JSCeal indicate a persistent threat. The malware's authors are actively investing in making their payloads harder to analyze and expanding their platform coverage, suggesting continued campaigns targeting retail traders and cryptocurrency investors globally.
The PEEP toolkit, a malicious Chrome extension derived from the open-source RedExt project, represents a significant evolution in post-compromise browser threats. Unlike JSCeal, which focuses solely on bypassing Google authentication via session cookie theft, PEEP expands its capabilities by leveraging a native-messaging bridge to execute OS-level commands. This allows PEEP to function as a remote backdoor, enabling attackers to perform file operations and discover running processes, thereby posing a broader post-compromise threat beyond just credential theft.