JSCeal Malware Steals Browser Sessions to Bypass Google Authentication and Target Crypto Users

Security researchers from Check Point Research have analyzed the malware and uncovered a broad set of capabilities, including browser credential theft, session-cookie harvesting, keylogging, screenshots, and web-traffic manipulation.

JSCeal is delivered through malicious advertising campaigns that impersonate legitimate cryptocurrency and trading services. Victims are redirected to fraudulent websites and encouraged to install fake software, including counterfeit versions of TradingView, ultimately leading to malware deployment.

Executive Summary

1. Threat Level: 🔴 High
2. Malware: JSCeal
3. Primary Target: Browser credentials and authenticated sessions
4. Initial Delivery: Malvertising and fake software installers
5. Key Capability: Session-cookie theft and replay
6. Primary Impact: Account takeover, credential theft and surveillance
7. Targeted Browsers: Chromium-based browsers
8. Cryptocurrency Targeting: Yes
9. First Documented: July 2025

JSCeal is particularly concerning because it does not rely solely on stealing usernames and passwords. Instead, it can extract active browser session cookies and use them to reconstruct authenticated sessions.

This technique can allow attackers to access accounts while bypassing the normal login process.

Key Takeaways

• JSCeal is a compiled V8 JavaScript malware designed to steal sensitive browser information.
• The malware can extract cookies, passwords, OAuth tokens and other browser data.
• Stolen session cookies can be used to replay authenticated sessions and potentially access Google accounts.
• JSCeal targets multiple Chromium-based browsers, including Chrome, Edge, Brave, Opera and Vivaldi.
• The malware uses multiple layers of JavaScript obfuscation to make analysis more difficult.
• It can record keystrokes and screenshots for additional surveillance.
• JSCeal can establish a local proxy capable of modifying selected web traffic.
• Cryptocurrency platforms including Binance, Bybit and Ledger are specifically targeted by some of its traffic-handling components.
• The malware continues to evolve, indicating ongoing development by its operators.
• How JSCeal Reaches Victims

The malware has been associated with malvertising campaigns that promote fake cryptocurrency and trading platforms.

Attackers use advertisements on platforms such as Google and Facebook to redirect potential victims to fraudulent websites.

These websites are designed to resemble legitimate cryptocurrency or trading services.

One observed technique involves impersonating TradingView and convincing visitors to download what appears to be a legitimate installer.

Instead, the downloaded software launches the JSCeal infection.

The Infection Chain

The attack can be summarized as:

Malicious Advertisement → Fake Trading Website → Fake Installer → Node.js Runtime → JSCeal → Browser Data Theft → Session Replay

The campaigns reportedly use PowerShell to deliver two ZIP archives. One contains the Node.js runtime, while the other contains the main malware and supporting components.

Stealing Browser Sessions

One of JSCeal's most dangerous capabilities is its ability to target browser session information.

The malware searches for browser profiles and attempts to extract stored information such as:

• Passwords
• Cookies
• OAuth tokens
• Authentication data
• Other browser secrets

The malware targets a wide range of Chromium-based browsers, including:

• Google Chrome
• Microsoft Edge
• Brave
• Opera
• Opera GX
• Avast Secure Browser
• Vivaldi
• Cốc Cốc

Why Stolen Cookies Are So Dangerous

Passwords are not the only way attackers can authenticate to online services.

After a successful login, websites commonly issue session cookies that allow the browser to remain authenticated.

If malware steals a valid session cookie, an attacker may be able to reuse that authenticated session.

This creates a major security problem:

Password → Authentication → Session Cookie → Session Theft → Session Replay

The attacker may not need to know the victim's password because the stolen session can already represent an authenticated user.

JSCeal contains functionality specifically designed to reconstruct browser sessions using stolen cookies and perform session-replay attacks against Google accounts.

MFA Does Not Automatically Stop Session Theft

Multi-factor authentication is highly effective against many credential-based attacks, but it does not necessarily protect an already-authenticated browser session.

If an attacker obtains a valid session token after the victim has successfully authenticated, the attacker may attempt to reuse that session rather than perform a new login.

This is why organizations should treat session-token theft as a distinct credential-access threat rather than relying exclusively on password and MFA protections.

Advanced Anti-Analysis Techniques

JSCeal is not simply a basic browser credential stealer.

The malware is compiled into V8 JavaScript bytecode, making traditional JavaScript analysis more difficult.

Its payload is also protected using javascript-obfuscator.

Researchers identified several techniques designed to complicate reverse engineering.

String Protection

Important strings are split into smaller components and protected using encoding and RC4-based encryption.

Control-Flow Flattening

The malware transforms normal program logic into a flattened structure controlled by state variables and loops.

This makes the original execution flow harder for analysts to understand.

Proxy Functions

JSCeal routes function calls through helper functions rather than directly executing common operations.

This adds another layer of complexity during static analysis.

Operation Wrappers

Even relatively simple operations can be placed inside dedicated helper functions.

Together, these techniques make automated analysis more difficult and increase the amount of work required from malware researchers.

Surveillance Capabilities

JSCeal extends beyond credential theft.

Researchers recovered functionality capable of:

• Recording keystrokes
• Capturing screenshots
• Collecting browser information
• Extracting authentication tokens
• Monitoring user activity

These capabilities allow operators to gather information that may not be stored directly inside browser databases.

For example, keystroke logging could capture information entered into applications or websites, while screenshots can reveal sensitive information displayed on the victim's screen.

Web Traffic Interception

Another notable capability is JSCeal's ability to establish a local proxy.

The malware can generate and install certificates and intercept selected web traffic.

Researchers found code capable of modifying requests and responses associated with particular services.

This functionality can potentially allow attackers to manipulate what victims see or modify traffic exchanged between applications and online services.

Cryptocurrency Targeting

JSCeal also contains functionality specifically focused on cryptocurrency services.

Recovered code includes configurations for:

• Binance
• Bybit
• Ledger

The malware can use service-specific handlers to modify web content, block hosts, clear selected cookies and collect account-related information.

Some components are capable of recording cryptocurrency balances and other account information.

For cryptocurrency users, this creates an additional risk because attackers may be interested not only in account credentials but also in identifying high-value targets.

Who Is Being Targeted?

The campaign appears particularly relevant to:

• Cryptocurrency investors
• Retail traders
• Users of online trading platforms
• Cryptocurrency exchange users
• Developers and technology users downloading unofficial software
• Users who click on trading-related advertisements

The broader campaign activity has been observed across multiple countries and languages, suggesting that the threat is not limited to a single geographic region.

Detection and Investigation

Security teams should look beyond traditional malware signatures when hunting for JSCeal or similar information stealers.

Useful areas for investigation include:

Browser Data Access

Look for non-browser processes accessing:

• Browser cookie databases
• Browser credential stores
• Local State files
• OAuth-related data
• Suspicious Node.js Activity

JSCeal's delivery chain includes the Node.js runtime.

Security teams should investigate unexpected Node.js processes, particularly when the runtime is launched from unusual user-writable directories or associated with recently downloaded software.

PowerShell Activity

Investigate PowerShell processes involved in downloading or extracting unexpected ZIP archives.

Network Activity

Look for unusual outbound connections from processes that normally should not communicate directly with external infrastructure.

Cryptocurrency Website Activity

Monitor endpoints for unexpected modifications or proxy activity involving cryptocurrency platforms.

What Users Should Do

1. Avoid Software From Untrusted Sources

Do not install trading or cryptocurrency software obtained from advertisements, unofficial websites or unknown download portals.

Download applications directly from the vendor's verified website whenever possible.

2. Be Careful With Search Advertisements

Malicious advertising can appear alongside legitimate search results.

A familiar company name or logo does not guarantee that the website behind an advertisement is legitimate.

3. Revoke Active Sessions After Infection

If a device is suspected of being infected with JSCeal or another information stealer, users should use a known-clean device to secure affected accounts and revoke active sessions.

4. Change Passwords

Passwords should be changed after the infected device has been isolated and cleaned.

Changing passwords while malware remains active may simply expose the new credentials again.

5. Review Account Activity

Check Google and other important accounts for:

• Unknown devices
• Suspicious sessions
• Unexpected account changes
• New recovery methods
• Unrecognized applications
• Unusual login activity

6. Protect Cryptocurrency Accounts

Cryptocurrency users should review exchange activity and account security settings for suspicious changes.

Where supported, hardware-backed authentication methods and withdrawal protections can provide additional layers of defense.

Recommendations for Organizations

Organizations should treat browser session tokens as sensitive authentication credentials.

Security teams should consider:

• Deploying EDR across endpoints.
• Monitoring browser credential-store access.
• Detecting suspicious Node.js execution.
• Restricting unauthorized software installation.
• Monitoring PowerShell activity.
• Blocking known malicious advertising and domains.
• Implementing application allowlisting where practical.
• Requiring managed browsers on corporate endpoints.
• Monitoring unusual OAuth and session activity.
• Providing security awareness training focused on malvertising and fake software.

Organizations using Google Workspace should also monitor for unusual session activity and account changes following suspected endpoint compromise.

Why JSCeal Matters

JSCeal demonstrates the changing nature of credential theft.

Attackers are increasingly interested in session tokens rather than passwords alone.

Once a browser session has been stolen, traditional authentication controls may not provide the same level of protection they provide during a normal login.

At the same time, JSCeal combines several capabilities—credential theft, session replay, surveillance and traffic manipulation—inside a single malware family.

This makes it a significant threat to both individual users and organizations.

Bottom Line

JSCeal represents a growing class of malware designed to steal the digital sessions users have already authenticated rather than simply attempting to guess or steal their passwords.

Its ability to extract browser cookies and replay authenticated sessions makes the malware particularly concerning, while its keylogging, screenshot capture and web-traffic interception capabilities provide attackers with additional ways to monitor victims and steal sensitive information.

The campaign also highlights an important security lesson: protecting passwords and enabling MFA is not enough if an endpoint itself becomes compromised.

For users, the best defense starts with avoiding malicious advertisements and fake software installers. For organizations, endpoint monitoring, browser protection and rapid session revocation should form part of a broader strategy for defending against modern information stealers.