Cybersecurity researchers have analyzed JSCeal, a sophisticated malware compiled into V8 JavaScript bytecode. Distributed primarily through malvertising campaigns on Facebook and Google Ads, the malware targets cryptocurrency traders by impersonating platforms like TradingView. It utilizes complex obfuscation techniques, such as control-flow flattening and RC4-protected strings, to hinder analysis and detection.
JSCeal boasts extensive surveillance and data-theft capabilities, including credential harvesting from Chromium-based browsers, session replay attacks, and keystroke logging. Furthermore, it implements a local proxy to intercept and modify traffic for major crypto exchanges like Binance and Bybit. Recent findings highlight a connection to the SourTrade operation, which uses in-memory browser assembly to bypass traditional network security layers.
Top comments (0)