Security researchers just got inside a nasty piece of malware called JSCeal. It's a compiled V8 JavaScript malware that steals your credentials, watches what you do, and intercepts your network traffic. And it's wrapped in so many layers of obfuscation that analyzing it is a nightmare.

Check Point Research published a technical breakdown of the malware. JSCeal first showed up in July 2025. Attackers were using fake cryptocurrency trading sites to spread it. Victims got redirected to these sites through malicious ads on Facebook and Google.

It employs the use of javascript-obfuscator to conceal its operations. RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers all work together to make analysis a headache.

Let me walk you through what JSCeal does and how it works.

Quick Summary

How JSCeal Hides Itself

JSCeal uses javascript-obfuscator with four main tricks:

1. Name Mangling

Function and variable names get replaced with random nonsense. Good luck reading that.

2. String Splitting and Encoding

Important strings are chopped up, encoded, and RC4-protected. They get put back together at runtime.

3. Control-Flow Flattening

The program flow gets turned into a flat mess controlled by an infinite loop and a state variable. Makes reverse-engineering a real pain.

4. Proxy Helpers and Wrappers

Function calls go through proxy helpers. Simple operations like addition or subtraction get wrapped in helper functions.

What a Researcher Said:

"JSCeal combines two forms of analysis friction: a version-specific compiled V8 format and several layers of JavaScript obfuscation applied before compilation. Neither makes the malware impossible to reverse, but together they move it outside the workflows that analysts normally rely on," said Aleksandra "Hasherezade" Doniec.

What JSCeal Actually Does

It Steals Your Browser Data:

JSCeal figures out what browsers you have installed and steals your saved secrets, cookies, OAuth tokens, and other data. It targets a bunch of Chromium-based browsers:

• Google Chrome
• Microsoft Edge
• Brave
• Opera
• Opera GX
• Avast Secure Browser
• Vivaldi
• Cốc Cốc

For each browser, it finds your user-data directory, lists your profiles, and pulls out cookies and passwords.

It Replays Your Sessions:

JSCeal uses stolen cookie data to reconstruct your browser session and replay it. This lets attackers bypass authentication and get into your Google account without needing your password.

It Watches You:

There's a second module that records your keystrokes and takes screenshots. Nothing you type or do is private.

The Proxy Trick

JSCeal sets up a local proxy that intercepts and modifies web content. This is a technique banking trojans love.

How It Works:

"A common technique used by banking trojans is to install a local proxy and inject or modify web content in selected services," Check Point said. "JSCeal follows a similar pattern: the recovered code shows proxy setup, certificate generation and installation, and service-specific request and response modification."

It's Not Just Passive:

"The proxy is not limited to passive interception. The recovered code contains dedicated handlers that modify selected requests and responses for specific services."

It Attacks Crypto Platforms:

• Binance
• Bybit
• Ledger

Other Handlers:

• HTML Substitution
• Host Blocking
• Cookie Removal

It Steals Crypto Wallets:

There are multiple handlers focused on cryptocurrency platforms. One of them captures account data and records your crypto balances.

The SourTrade Connection

JSCeal is linked to a big malvertising operation called SourTrade. Confiant exposed details of this campaign last month.

What SourTrade Does:

It impersonates trusted trading and cryptocurrency brands like Solana, Luno, and TradingView. It serves fake portals with malicious JavaScript that tells your browser to assemble malware directly in memory.

The Clever Part:

"What makes SourTrade technically distinct is what happens on its landing page," Confiant said. "It does not distribute finished malware. Instead, it delivers assembly instructions to the victim's browser, retrieves a clean legitimate file from separate infrastructure, and directs the browser to build the final malware in memory on the victim's machine. No finished malware ever exists on the network."

The Campaign:

• Active since late 2024
• Targets retail traders and cryptocurrency investors
• 12 countries, 25 languages
• Mostly Asia Pacific and Latin America

How JSCeal Spreads

The Delivery:

• Malvertising campaigns use two ZIP archives delivered via PowerShell:
• One with the Node.js runtime
• One with the main payload and other components

The Infection Chain:

• You click a malicious ad on Facebook or Google
• You get redirected to a fake cryptocurrency trading site
• You're told to download a bogus TradingView installer
• JSCeal gets deployed

The Overlap:

This campaign overlaps with a JSCeal campaign Bitdefender described in September 2025.

How to Protect Yourself

The Risks:

• Your credentials get stolen
• Your accounts get taken over
• Your crypto gets stolen
• Financial fraud

Who's Targeted:

• Retail traders
• Cryptocurrency investors
• People using trading platforms

What to Do:

1. Beware of Advertisements

Malicious advertisements spread by Facebook and Google constitute the primary method of transmission. Avoid downloading any advertisement stating itself to be a promotional offer for trading of cryptocurrencies.

2. Install Software Only from Official Websites

Install TradingView and any other trading software only from official websites of such organizations.

3. Check for Software Installations

Check your software installations to determine if there are any unauthorized installations of software.

4. Turn On Two-Factor Authentication

Turn on two-factor authentication on your account. This will guard you against the session replay attack.

5. Protect Your Accounts

It is essential that you protect your accounts.

Bottom Line

JSCeal is a sophisticated piece of malware that engages in credential theft, spying, and man-in-the-browser attacks. The malware spreads via malicious advertising campaigns aimed at cryptocurrency traders.

What You Need to Know:

What Needs to be Done:

• Be careful of the ads which promote trading platforms.
• Install software from authentic sources.
• Check the installed software.
• Enable two-factor authentication.
• Check your account for any suspicious activity.

FAQ Section

What is JSCeal?

A malware used for credential stealing, surveillance, and traffic interception activities. It spreads through malicious advertisements targeted at cryptocurrency traders.

How does JSCeal spread?

You click a malicious ad, get redirected to a fake trading site, and download a bogus TradingView installer that deploys the malware.

What does JSCeal steal?

Web browsing cookies, passwords, OAuth tokens, crypto accounts and their balance. It also captures keystrokes and screenshots.

What is SourTrade?

Malvertising campaign that mimics legitimate trading sites to create malware right in your web browser memory.

What should I do?

Beware of malicious ads, download from reputable sites, scan for installed software, use two-factor authentication, and watch your accounts.

Source: The Hacker News