JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies
JSCeal, a sophisticated compiled V8 JavaScript malware, is being used in a widespread malvertising campaign targeting retail traders and cryptocurrency investors globally. The campaign, linked to threat actors like WEEVILPROXY and MeadowLocust, leverages fake cryptocurrency trading sites to deliver malicious installers and employs advanced obfuscation techniques to evade detection. The malware steals browser data, including cookies and OAuth tokens, to bypass authentication and conduct session replay attacks, and also offers surveillance capabilities like keystroke logging and screenshot capture. The campaign has been active since late 2024 and continues to evolve, indicating ongoing development and expansion of its capabilities.
Cybersecurity researchers have uncovered JSCeal, a complex compiled V8 JavaScript (JSC) malware, currently deployed in a large-scale malvertising campaign. The campaign is linked to threat actors known as WEEVILPROXY and MeadowLocust and is targeting retail traders and cryptocurrency investors across 12 countries in 25 languages, primarily in Asia Pacific and Latin America. The campaign began in late 2024 and continues to be active.
JSCeal utilizes fake cryptocurrency trading sites – mimicking brands like Solana, Luno, and TradingView – to redirect unsuspecting users to malicious installers. These installers lead to the deployment of the malware. A key aspect of the campaign is the use of a ‘no-distribution’ approach, where the landing page delivers assembly instructions to the victim’s browser, which then builds the final malware in memory. This prevents finished malware from residing on the network, making detection more difficult.
JSCeal is protected using JavaScript obfuscation, employing multiple layers of transformations to hinder analysis. These include replacing function and variable names with short identifiers, splitting strings into chunks and encoding them, and utilizing control-flow flattening to create a single-level switch statement. The malware also leverages a ‘proxy’ technique, installing a local proxy and modifying web content in selected services, including cryptocurrency platforms like Binance and Bybit.
The malware targets a wide range of Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Avast Secure Browser, Vivaldi, and Cốc Cốc. It extracts cookies and OAuth tokens from these browsers, enabling it to reconstruct browser sessions and conduct active session replay attacks to bypass authentication and gain unauthorized access to Google accounts. Furthermore, JSCeal includes a surveillance module that records keystrokes and takes screenshots.
Researchers have developed a ‘fully static deobfuscation pipeline’ to decode the compiled V8 JavaScript bytecode, providing insights into the malware’s execution flow and capabilities, including its ability to enumerate installed browsers and query saved secrets. The campaign’s ongoing development and expansion suggest that JSCeal remains under active development and is continually evolving to evade detection and broaden its platform coverage.