Loading story…
Check Point Research analyzed JSCeal, an actively developed Node.js/V8-based infostealer that steals browser credentials and cookies, Google OAuth tokens, cryptocurrency-account data, keystrokes, screenshots, and active-window information. Stolen browser cookies can enable attackers to reconstruct victim sessions, while the malware can automate elements of Google authentication with compromised passwords and collect newly issued Android-scoped OAuth tokens.
JSCeal also installs an attacker-controlled root certificate and operates a local HTTPS interception proxy, enabling manipulation of traffic and content associated with cryptocurrency platforms including Binance, Bybit, Ledger, and Kraken. Recent versions adopted renamed and obfuscated launchers, a newer Node/V8 runtime, and AES-256-CBC encryption wrapping Brotli-compressed payloads; observed macOS targeting indicates that its operators are continuing to broaden platform coverage.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
At Black Hat USA 2026, Check Point Research presented a JSCeal-specific extension to the View8 V8-bytecode decompiler. The pipeline recovered readable output from 23 analyzed samples by decrypting strings and removing proxy-function and obfuscation layers.
The first observed JSCeal payload protected with AES-256-CBC encryption around a Brotli-compressed payload was generated; its MD5 was 581e2e2265d0c1509b3799c5a9039374.
Campaigns beginning in early November 2025 upgraded JSCeal's bundled Node/V8 runtime to V8 13.6.233.10-node.28.
Campaigns beginning in late October 2025 used a JSCeal payload bundled with V8 10.2.154.26-node.25 (MD5 0d1fce0cb2b9dec26a10f0822aeffb19).
JSCeal, an information-stealing malware distributed as compiled V8 bytecode and executed with a bundled Node.js runtime, was active by at least March 2024. The malware targets cryptocurrency applications and has also been tracked under the names WEEVILPROXY and MeadowLocust.
Researchers documented that JSCeal steals browser cookies and OAuth tokens, then can reconstruct browser sessions to replay access to victims' Google accounts. The malware also includes surveillance features and a local proxy capable of installing certificates and intercepting or modifying selected HTTP traffic, including cryptocurrency-service requests.
JSCeal campaigns were also observed targeting macOS, including a sample with MD5 de10c6b3dc4619f59bc9c80a0aa15e6a.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 119 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourceinfosec.pub
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a new macOS infostealer, **AmnesiaStealer**, being spread through **ClickFix-style** social engineering that tricks users into copying and pasting a malicious command into Terminal, including via fake GitHub download pages. The multi-stage infection chain uses a Bash loader to profile the host and retrieve a processor-specific Mach-O payload written in Go, then steals browser passwords, Apple Keychain data, cached credentials, Telegram sessions, Apple Notes, documents, and other sensitive information from infected systems. Investigators said the malware also includes cryptocurrency-theft functionality that can transfer wallet funds to attacker-controlled addresses, and a later-stage component, `stream_module`, can be fetched on demand to clone browser profiles and attach to the Chrome DevTools Protocol for covert access to already authenticated browser sessions. Huntress linked parts of the loader, payload-hosting, and command-and-control infrastructure to the **Aeza Group**, a sanctioned Russian bulletproof hosting provider tied to cybercrime, while Jamf noted some privacy-bypass methods are outdated on newer macOS releases even though the malware’s credential theft and session-hijacking features remain effective.
Aug 24, 2026
**Storm** is a newly advertised infostealer sold as a subscription-based cybercrime service that steals browser credentials, cookies, refresh tokens, cryptocurrency wallet data, documents, messaging app session data, screenshots, and system information. Reporting indicates it targets **Chromium** and **Gecko**-based browsers, including Chrome, Edge, Firefox, and Waterfox, while also going after services and apps such as **Telegram**, **Discord**, **Binance**, and **Coinbase**. Investigators observed victim logs spanning multiple countries, including India, Brazil, the United States, and the United Kingdom, and a criminal panel showing more than 1,700 log entries. The malware’s distinguishing feature is **server-side decryption**, which allows stolen browser data to be exfiltrated in encrypted form and decrypted on attacker-controlled infrastructure rather than on the victim device. That design reduces endpoint telemetry, helps evade antivirus detection, and reportedly undermines Chrome’s **App-Bound Encryption** protections. Storm also includes automated cookie restoration and the use of geographically matched **SOCKS5** proxies to re-establish authenticated sessions, enabling attackers to bypass password-based defenses and, in some cases, render **MFA** ineffective while accessing SaaS accounts, Microsoft 365, internal tools, and cloud environments.
Jun 29, 2026
Threat actors used Facebook advertisements impersonating a cryptocurrency exchange and promising digital-asset rewards to distribute the Node.js-based **JSCEAL** malware. Victims were routed to convincing counterfeit exchange sites that profiled browser, campaign, and operating-system information before serving platform-specific installers. AhnLab reported roughly 1,500 Windows and macOS infections in South Korea during August and September 2026. On Windows, the campaign used a malicious BAT loader to invoke PowerShell, create scheduled-task persistence, add a Microsoft Defender exclusion, and execute JavaScript or V8 bytecode through an embedded Node.js runtime. On macOS, a fraudulent PKG installer downloaded shell scripts, collected and validated the user's password, exfiltrated host and clipboard data, registered a LaunchAgent for persistence, and launched additional JavaScript-based payloads. Organizations should treat cryptocurrency-reward advertising as a likely social-engineering lure and block or investigate related counterfeit exchange downloads.
Sep 30, 2026