JSCeal is a sophisticated infostealer delivered as compiled V8 bytecode and executed via a bundled Node.js runtime. Primarily targeting cryptocurrency applications and browser data, its use of version-specific bytecode and heavy source-level obfuscation presents significant challenges for traditional security analysis and reverse-engineering tools.
Researchers at Check Point developed a specialized static deobfuscation pipeline by extending the open-source View8 decompiler. This pipeline automates the reconstruction of encrypted strings, unflattens complex control flows, and resolves proxy functions. This transformation converts opaque bytecode into readable pseudocode, enabling analysts to map the malware's logic and validate its data-exfiltration behaviors.
The malware's capabilities are extensive, featuring Puppeteer-driven automation to bypass authentication and steal Google OAuth tokens. It also includes modules for keylogging, screenshot capture, and a local HTTPS interception proxy used for web content modification. By installing a custom root certificate, JSCeal can intercept and manipulate traffic for major cryptocurrency exchanges such as Binance and Bybit.
Top comments (0)