JSCeal Hides Crypto Malware in V8 Bytecode
JSCeal Hides Crypto Malware in V8 Bytecode
🚨 JSCeal is a sophisticated cryptocurrency-stealing malware that has been tracked by Check Point Research since early 2025. This malware cleverly hides itself in V8 bytecode, the format used by Chrome and Node.js to run JavaScript efficiently. Researchers have developed a tool to decompile it and reveal its advanced theft capabilities.
How JSCeal Works
Instead of delivering standard JavaScript, JSCeal compiles its malicious code into V8 bytecode (.jsc) and executes it using a bundled Node.js runtime. This method significantly complicates the analysis process, as the malware undergoes two transformations: it is heavily obfuscated and then compiled into a version-specific bytecode format.
Capabilities of JSCeal
The recovered code showcases a broad toolkit designed for financial theft:
- Steals saved passwords and cookies from eight different Chromium-based browsers.
- Harvests Telegram session data.
- Logs keystrokes and takes screenshots.
- Installs a locally generated, attacker-controlled certificate to intercept and modify HTTPS traffic.
This last capability allows it to silently alter what victims see on legitimate financial platforms, such as swapping login QR codes on Binance or replacing scripts served by Ledger’s website with malicious content.
Evolving Threat
JSCeal continues to evolve, with later samples upgrading to a newer Node.js runtime that broke compatibility with existing disassemblers. It has also introduced an AES encryption layer around the compressed payload, with the decryption key provided externally. The malware has expanded its targeting to macOS for the first time, indicating active and well-resourced development.
Conclusion
If your organization interacts with cryptocurrency infrastructure, this report is essential reading. The local proxy and certificate installation techniques employed by JSCeal pose significant risks, regardless of the specific exchange your team uses.