JSCeal is a sophisticated infostealer malware delivered as compiled V8 bytecode and executed via a bundled Node.js runtime. Primarily targeting cryptocurrency applications, it utilizes heavy source-level obfuscation and version-specific bytecode to complicate traditional reverse engineering. To combat this, researchers developed a specialized static deobfuscation pipeline based on the View8 decompiler, enabling the reconstruction of the malware's semantics and logic despite the lossy nature of V8 compilation.
The malware's capabilities are extensive, including the theft of browser cookies, passwords, and OAuth tokens, alongside keylogging and screenshot capture. JSCeal further distinguishes itself by deploying a local HTTPS interception proxy to inject or modify web content on platforms like Binance and Bybit. By leveraging Puppeteer for automated browser interactions and installing attacker-controlled root certificates, it effectively bypasses authentication challenges to exfiltrate sensitive financial data.
Top comments (0)