- Cybersecurity researchers have unveiled JSCeal, a sophisticated compiled V8 JavaScript malware used to steal credentials and intercept traffic.
- A related malvertising campaign named SourTrade delivers assembly instructions to victims’ browsers to build malware directly in memory.
- The malware targets cryptocurrency platforms like Binance, Bybit, and Ledger, using advanced obfuscation and proxy techniques to bypass security analysis.
Check Point Research has uncovered JSCeal, a sophisticated compiled V8 JavaScript malware that performs credential harvesting, surveillance, and traffic interception against cryptocurrency investors. The malware is distributed through fake trading sites and malicious ads on Facebook and Google that redirect users to bogus installers for TradingView.
The payloads are protected with javascript-obfuscator, using techniques including RC4-protected strings and control-flow flattening to hinder analysis. First documented by Check Point in July 2025, the activity overlaps with threat clusters known as WEEVILPROXY and MeadowLocust.
Meanwhile, ad security platform Confiant disclosed details of a massive malvertising operation codenamed SourTrade, active since late 2024 and targeting retail traders across 12 countries. “What makes SourTrade technically distinct is what happens on its landing page,” Confiant said, noting it delivers assembly instructions to build the final malware in memory on the victim’s machine.
Check Point developed a fully static deobfuscation pipeline to decode the compiled V8 bytecode, revealing the malware’s browser-stealing module. This module targets Chromium-based browsers like Google Chrome, Microsoft Edge, Brave, and Opera GX to extract cookies and passwords.
Consequently, JSCeal can use stolen cookies to conduct active session replay attacks, bypassing authentication to gain unauthorized access to Google accounts. A second module embedded within the malware offers surveillance capabilities by recording keystrokes and taking screenshots.
The malware also sets up a local proxy to intercept and modify web content, with specific handlers for Binance, Bybit, and Ledger. “A configuration function exposes separate overrides for Binance, Bybit, and Ledger, as well as generic handlers for replacing HTML,” the researchers explained.
Security researcher Aleksandra Doniec noted the malware combines version-specific compiled V8 format with JavaScript obfuscation, moving it outside typical analysis workflows. “Taken together, these developments show that the JSCeal authors are investing both in making the payload harder to analyze and in broadening its platform coverage,” she said.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
