DeafNews
// 1 CRITICAL · 11 ZERO-DAY · 9 CVE · 10 EXPLOIT IN THE LAST 24H→
Malware

JSCeal Steals Session Cookies to Bypass Google Authentication

Published: Updated: By Samuel Segato 7 min read Malware
Share
WhatsApp Facebook X (Twitter) LinkedIn Reddit Telegram Email
The JSCeal malware compiles JavaScript into V8 bytecode to steal session cookies and circumvent Google authentication systems. Check Point Research reveals a dual transformation technique — multi-layer obfuscation followed by V8 bytecode compilation — that renders standard reverse-engineering tools ineffective. The campaign, actively tracked since March 2024, was presented at Black Hat USA 2026 alongside an open-source deobfuscation toolkit.

Check Point Research has published the definitive analysis of JSCeal, a JavaScript infostealer that compromises already-authenticated sessions on Google services by stealing session cookies from the victim's browser. The malware, actively tracked since March 2024, employs a dual technical transformation — multi-layer obfuscation followed by compilation into V8 bytecode — that makes analysis practically impossible with standard reverse-engineering tools. The research was presented at Black Hat USA 2026 and accompanied by the release of an open-source toolkit for static deobfuscation.

Key Takeaways
  • JSCeal steals browser session cookies to bypass Google authentication without static credentials
  • Malicious code is obfuscated with javascript-obfuscator then compiled into V8 bytecode (.jsc), rendering conventional JavaScript analysis tools useless
  • The malware installs a local MITM proxy on 127.0.0.1 with self-generated certificates to intercept and modify HTTPS traffic
  • Check Point analyzed 23 payloads and released a View8-based deobfuscation pipeline, but authors are already evolving toward new V8 versions and macOS targeting

The Infection Chain: From Facebook to a Hidden Node.js Runtime

The campaign documented by Check Point begins with malvertising on platforms such as Facebook and Google. The ad click redirects the victim to fake cryptocurrency trading sites, which in turn distribute counterfeit TradingView installers. Final execution occurs via PowerShell with the command node.exe -r preflight.js app.jsc — a detail that reveals the malware's fundamental architecture: a bundled Node.js runtime executing precompiled V8 bytecode.

This choice is not accidental. Compilation into the .jsc format eliminates the JavaScript source code, replacing it with bytecode instructions specific to the V8 engine version. Analysts opening the file with standard tools find unreadable binary data, not obfuscated text to deobfuscate. The problem shifts from a domain where security has decades of experience — JavaScript analysis — to one where publicly available tools are scarce and fragmented.

How Identity Theft Works Without Passwords

The mechanism of greatest interest is the bypass of Google authentication. According to the Check Point dossier, JSCeal does not attempt to steal the user's password. Instead, it extracts session cookies from the browser — those temporary tokens that keep an already-verified identity active — and transmits them to the malware operators. With these cookies, the attacker can impersonate the victim on Google services until the session's natural expiration or until the user explicitly revokes access.

The dossier does not specify whether the malware actively manages session renewal or operates only on the initial token. What is documented is the additional capability for keylogging, screenshots, browser credential theft, and extraction of data from cryptocurrency wallets (Binance, Phantom). Added to this exfiltration component is the local MITM proxy: JSCeal creates a server on 127.0.0.1, generates RSA key pairs and certificates, and intercepts HTTPS traffic to modify it in transit. The pattern is classic banking trojan behavior, applied here to a cloud and financial services ecosystem.

"JSCeal combines two forms of analysis friction: a version-specific compiled V8 format and several layers of JavaScript obfuscation applied before compilation. Neither makes the malware impossible to reverse, but together they move it outside the workflows that analysts normally rely on" — Aleksandra 'Hasherezade' Doniec, Check Point Research

Obfuscation as Architecture: Three Layers of Invisibility

Even before V8 compilation, the JavaScript source code undergoes intensive treatment with javascript-obfuscator. Documented techniques include: strings encrypted with RC4, control-flow flattening that destroys code linearity, proxy functions that mask real calls, and operation wrappers that render even the simplest arithmetic operations opaque. The result is code that, even when deobfuscated, requires manual reconstruction of logic.

After this phase, V8 compilation with a specific version intervenes — in the sample analyzed in detail, V8 10.2.154.26-node.25. The resulting bytecode is lossy: it does not preserve variable names, comments, or original code structure. Check Point extended the open-source View8 project to generate analyzable pseudocode, but the dossier explicitly emphasizes that the output is not the original source. The pipeline worked on all 23 payloads examined over several months, but the source does not guarantee efficacy on future variants.

Active Evolution: From Windows to macOS, With New V8 Versions

The JSCeal sample is not a static artifact. Check Point documents continuous development: new V8 engine versions, additional encryption layers, and — an element that amplifies risk — expansion of targeting toward macOS. This last point is particularly relevant because the bundled Node.js execution context works cross-platform with minimal modifications, and the macOS analysis community has even less familiarity with .jsc artifacts than its Windows counterpart.

The malware is also tracked under the names WEEVILPROXY and MeadowLocust, which the dossier presents as vendor operational tracking labels — not as attribution to an identified threat actor group. No infrastructure overlaps emerge linking the operators to known campaigns at the level of geopolitical attribution. A technical overlap with the SourTrade campaign reported by Confiant in August 2026 is documented instead: malvertising spread across 12 countries primarily in Asia-Pacific and Latin America, with landing pages in 25 languages, using in-memory payload assembly techniques in the browser.

What to Do Now

  • Invalidate active sessions on Google services after detecting suspected compromise: the stolen cookie remains valid until explicit revocation
  • Include .jsc artifacts and bundled Node.js runtimes in forensic triage workflows, which standard JavaScript tools do not analyze natively
  • Evaluate adoption of the extended Check Point View8 pipeline for static deobfuscation of V8 bytecode, publicly available
  • Monitor evolution of the JSCeal toolkit and variants: research indicates active development on new V8 versions and additional platforms

Why JSCeal Changes the JavaScript Threat Perimeter

The lesson of JSCeal goes beyond a single malware. For years, the security ecosystem has treated JavaScript as source code — obfuscatable, but always reversible with mature techniques. V8 compilation shifts the problem into a register where analysis requires knowledge of engine-specific bytecode, version by version. The release of the Check Point toolkit is a first corrective, but the dynamic is that of an arms race: every defensive advance on decompilation can be countered by target engine updates or migration to less-monitored platforms.

The most unsettling datum remains the ease with which an authenticated session — the result of years of investment in two-factor and passwordless authentication — becomes stealable merchandise through a cookie. JSCeal does not breach Google: it abuses an architectural characteristic of the web, session persistence, that users consider convenience and attackers consider attack surface. The question the industry must ask is how much of its analytical workflow is ready for code that is no longer JavaScript, but retains all its danger.

FAQ

Does JSCeal exploit a Google or Node.js vulnerability?

No. The malware uses legitimate mechanisms: V8 compilation as an obfuscation technique, and session cookies as an already-valid authentication mechanism. No zero-day in the runtime is documented.

Can antivirus detect JSCeal?

The dossier does not document detection rates. The .jsc structure and multi-layer obfuscation reduce visibility for signatures based on source-code patterns, but Check Point does not offer assessments on existing endpoint security capabilities.

Does the Check Point toolkit decrypt the original source?

No. The pipeline generates analyzable pseudocode from decompilation of V8 bytecode. Compilation is lossy: variable names, comments, and parts of the original structure are unrecoverable.

Sources

Information has been verified against cited sources and updated at time of publication.

Sources

Sources and references
  1. thehackernews.com
  2. gbhackers.com
  3. research.checkpoint.com