Cybersecurity researchers at Check Point Research have uncovered new details about JSCeal, a sophisticated information-stealing malware focused on cryptocurrency users.
The malware is particularly concerning because it does more than steal passwords. Researchers found that JSCeal can recover browser session information, interact with Google authentication flows, intercept HTTPS traffic and manipulate web sessions associated with services such as Binance, Bybit and Ledger.
The campaign also demonstrates how malicious advertising can become the first step in a highly technical malware infection.
What is JSCeal?
JSCeal is a cryptocurrency-focused infostealer delivered as compiled V8 JavaScript bytecode and executed through a bundled Node.js runtime.
Check Point Research has been tracking the malware since early 2025, while campaign activity dates back to 2024. The researchers have also associated JSCeal with the names WEEVILPROXY and MeadowLocust.
The malware is heavily protected against analysis. Its JavaScript code uses obfuscation techniques including encrypted strings, control-flow flattening and proxy functions before being compiled into V8 bytecode. This makes the final payload significantly harder for security researchers to analyze.
How victims are targeted
JSCeal has been distributed through malvertising campaigns on platforms including Google and Facebook.
In previously documented campaigns, users were directed toward fraudulent cryptocurrency trading websites that impersonated legitimate services. Some campaigns used fake applications, including bogus TradingView installers, to convince victims to download software.
Check Point previously reported more than 35,000 malicious advertisements associated with the campaign during the first half of 2025, generating millions of impressions in Europe alone.
This is an important part of the attack: the initial advertisement may look legitimate because it appears through a familiar advertising ecosystem. The danger begins when the victim follows the advertisement and installs the supposedly legitimate application.
JSCeal goes beyond password theft
The latest Check Point analysis shows that JSCeal contains a broad collection of information-stealing and surveillance capabilities.
Researchers recovered functionality for:
- Browser credential theft
- Session and cookie theft
- Keylogging
- Screenshots
- Cryptocurrency-related data collection
- HTTPS traffic interception
- Manipulation of selected web requests and responses
- Blocking selected hosts
- Clearing selected browser cookies
The malware has specific handlers for Binance, Bybit and Ledger, allowing it to perform actions tailored to these services rather than simply collecting generic browser data.
How can it bypass Google authentication?
One of the more concerning capabilities identified by researchers involves Google authentication sessions.
JSCeal can inject previously recovered browser cookies into a controlled browser session and interact with Google's authentication infrastructure. Researchers found functionality that can enumerate Google accounts present in the session, correlate them with previously recovered passwords and retrieve authentication-related cookies and OAuth tokens.
This is better understood as session and authentication-token theft rather than a conventional break of Google's MFA cryptography.
If an attacker obtains a valid authenticated session or token, they may be able to operate within that session without having to defeat the MFA mechanism in the traditional sense. The effectiveness depends on the specific authentication flow, token and security controls involved.
That distinction matters. MFA can still be highly effective, but it cannot by itself protect a device that has already been compromised and is actively exposing authenticated sessions.
JSCeal can intercept HTTPS traffic
Another particularly advanced capability is the use of a local man-in-the-middle proxy.
According to Check Point, the malware can configure a local proxy, generate and install a certificate and intercept HTTPS traffic. It also contains handlers capable of modifying selected requests and responses.
This gives the malware a way to operate between the browser and online services rather than simply reading files from the browser profile.
For cryptocurrency users, that can be especially dangerous because the attacker may be able to observe or manipulate information associated with targeted web applications.
Why cryptocurrency accounts are attractive targets
Cryptocurrency platforms combine several characteristics that make them attractive to information stealers.
A compromised browser may contain:
- Active authenticated sessions
- Exchange credentials
- Authentication tokens
- Cryptocurrency-related browser extensions
- Sensitive account information
- Transaction and balance information
JSCeal's service-specific functionality suggests that its operators are interested in exploiting this environment rather than relying solely on traditional credential theft.
However, the presence of these capabilities does not mean that every infected system will automatically result in cryptocurrency theft. The outcome depends on the victim's browser configuration, authentication state, security controls and the specific malware variant.
JSCeal is still evolving
Check Point Research also found evidence that the malware continues to change.
More recent samples use newer Node.js/V8 versions, additional encryption and other modifications intended to increase the difficulty of analysis. Researchers also identified samples targeting macOS, indicating that the malware's reach is not limited to Windows environments.
The use of compiled V8 bytecode is itself an interesting defensive challenge. Instead of receiving ordinary JavaScript source code, analysts have to reconstruct the malware from a version-specific compiled format before they can properly understand its functionality.
Who should be concerned?
The immediate risk is greatest for people and organizations that use cryptocurrency services through browsers, particularly when those users install software promoted through online advertisements.
Businesses should also consider the wider risk.
An infected employee workstation does not have to contain cryptocurrency to become valuable to an attacker. Browser sessions, passwords, cookies, OAuth tokens and credentials can potentially provide access to corporate services.
This makes browser security an increasingly important part of identity security.
How to protect against JSCeal
Organizations and users should consider the following measures:
✅ Do not install software promoted through suspicious advertisements.
Use the vendor's official website or trusted application store rather than following download links from advertisements.
✅ Treat cryptocurrency advertisements with particular caution.
A convincing Google or Facebook advertisement does not prove that the destination is legitimate.
✅ Protect browser sessions.
Session cookies and authentication tokens can be as valuable as passwords once a device is compromised.
✅ Use phishing-resistant MFA where possible.
Hardware security keys and passkeys provide stronger protection against many credential-based attacks, although endpoint compromise still needs to be addressed.
✅ Monitor unusual browser and authentication activity.
Unexpected sessions, new devices, unfamiliar OAuth activity or abnormal account behavior should trigger investigation.
✅ Use endpoint protection and application controls.
Malware such as JSCeal relies on executing components on the endpoint, making endpoint detection and application control important layers of defense.
✅ Separate high-value accounts.
Administrators and cryptocurrency operators should avoid using the same browser environment for everyday browsing and highly sensitive accounts.
Final thoughts
JSCeal demonstrates how modern information stealers are moving beyond simple password collection.
The combination of malvertising, browser session theft, authentication-token abuse and HTTPS interception gives attackers multiple ways to operate after a device has been compromised.
The most important lesson is that MFA is not a substitute for endpoint security. Strong authentication can prevent many account-takeover attempts, but once malware controls a trusted browser session, attackers may be able to abuse the authenticated state itself.
Protecting identity today means protecting the endpoint, the browser session and the authentication tokens—not just the password.
