Cybersecurity researchers have detailed JSCeal, a sophisticated compiled V8 JavaScript malware designed for credential harvesting, surveillance, and traffic interception. Primarily targeting cryptocurrency investors through malvertising on Facebook and Google, the malware utilizes the "SourTrade" assembly technique to build payloads directly in a victim's memory, bypassing traditional file-based detection. The malware is heavily protected with layers of obfuscation, including control-flow flattening and RC4-protected strings, requiring specialized static deobfuscation pipelines for analysis.
The malware's capabilities are extensive, featuring modules that can enumerate profiles across multiple Chromium-based browsers to steal cookies, passwords, and OAuth tokens. It is equipped to perform session replay attacks to bypass multi-factor authentication and includes a local proxy system to modify traffic for specific platforms like Binance, Bybit, and Ledger. These developments indicate that the threat actors are actively refining JSCeal's capabilities to increase both its stealth and its impact on the cryptocurrency ecosystem.
Top comments (0)