Cybersecurity researchers have detailed JSCeal, a sophisticated compiled V8 JavaScript malware utilized in malvertising campaigns to target cryptocurrency investors. The malware employs advanced obfuscation techniques, including RC4-protected strings and control-flow flattening, to evade detection and complicate reverse engineering. It is primarily delivered via fake trading sites promoted through malicious ads on platforms like Facebook and Google, often leading to the deployment of Node.js-based payloads.
JSCeal is capable of extensive credential harvesting, browser session hijacking, and surveillance through keylogging and screen captures. By leveraging a local proxy, it can intercept and modify traffic for specific cryptocurrency platforms like Binance and Ledger. Researchers have developed a static deobfuscation pipeline to bypass these protections, revealing that the malware remains under active development and continues to broaden its platform coverage.
Top comments (0)