Static Deobfuscation Pipeline Unlocks Analysis of JSCeal Cryptocurrency Stealer
Check Point Research unveils a static deobfuscation pipeline for JSCeal, a malware that steals cryptocurrency by delivering its payload as compiled V8 bytecode.
Check Point Research (CPR) has developed a novel static deobfuscation pipeline capable of analyzing JSCeal, a sophisticated malware primarily targeting cryptocurrency but also possessing broader capabilities for credential theft, surveillance, and traffic interception. The malware is delivered as compiled V8 bytecode, making traditional JavaScript analysis tools ineffective. CPR's pipeline, built upon the View8 decompiler, reconstructs obfuscated JavaScript code without requiring execution, thereby enabling a deeper understanding of its malicious functions.
JSCeal has been active since early 2025, with its campaign activity dating back to March 2024. The malware employs multiple layers of obfuscation, including RC4-protected strings and control-flow flattening, before being compiled into V8 bytecode. This compilation process transforms the code into a format that is difficult for analysts to reverse-engineer, as it removes much of the information that source-oriented tools rely on. The attacker's motivation for this approach is its cost-effectiveness, leveraging readily available tools like Node.js and javascript-obfuscator.
The core of CPR's solution is an extended version of the open-source View8 decompiler. The research team enhanced View8 to ensure reproducible output and facilitate automated post-processing. Their pipeline includes dedicated stages for value propagation, string reconstruction, control-flow unflattening, and the resolution of proxy and operation wrappers. While the goal is not to recover perfect source code, the recovered pseudocode is structured and semantically rich enough to allow analysts to follow the malware's logic, compare different samples, and identify specific capabilities.
The deobfuscated output has revealed JSCeal's extensive functionalities. These include keylogging, the theft of browser and cryptocurrency wallet credentials, and the ability to intercept HTTPS traffic by deploying a local Man-in-the-Middle (MITM) proxy. The research team presented these findings at Black Hat USA 2026, with this article providing more in-depth technical details and examples.
JSCeal payloads are typically delivered via malvertising campaigns, followed by a series of PowerShell scripts. The final stage involves downloading two ZIP archives: one containing a packaged Node.js runtime and the other holding the malware payload, support components, and a decompression script. The final JSC payload is often Brotli-compressed and decompressed by a preflight script before execution via the Node.js runtime.
Recent developments in JSCeal campaigns are also noted, including the targeting of macOS systems. Furthermore, the malware has been observed using V8 code caches generated for newer Node.js/V8 versions and incorporating an additional payload-encryption layer, indicating its ongoing evolution and adaptation to evade detection.
The complete toolkit for this static deobfuscation pipeline, named jsc_deobfuscator, has been made publicly available by Check Point Research. This release aims to empower security researchers and analysts with the tools necessary to dissect and understand complex, bytecode-based malware like JSCeal, thereby improving defenses against such threats.