JSCeal Malware Replays Stolen Cookies to Bypass Google Login

Security researchers have published new details about JSCeal, a piece of malware that steals session cookies and other saved browser data, then replays those sessions to enter a victim's Google account without the password. In a technical report published last week, Check Point Research described JSCeal as a sophisticated compiled V8 JavaScript malware, meaning its code is turned into a low-level format that runs inside the browser's V8 engine and is much harder to read than ordinary JavaScript. The malware has three main capabilities: harvesting credentials, watching what a victim types and sees, and intercepting web traffic.

Check Point first documented JSCeal in July 2025. The researchers said attackers used fake cryptocurrency trading sites that users reached through malicious advertisements on Facebook and Google. Those counterfeit sites told visitors to download bogus installers for TradingView, a legitimate financial charting tool, and running those installers deployed the malware. The activity overlaps with a threat cluster tracked under the names WEEVILPROXY and MeadowLocust. The malvertising campaigns deliver two ZIP archives through PowerShell, a command-line and scripting tool built into Windows: one contains the Node.js runtime, and the other contains the main payload and additional helper components.

More recently, ad security firm Confiant published details of a large malvertising operation it calls SourTrade. Malvertising is the term for malicious code hidden inside online advertisements. According to Confiant, SourTrade impersonates trusted trading and cryptocurrency brands such as Solana, Luno, and TradingView. It serves lookalike portals with malicious JavaScript that tells the victim's browser to assemble malware directly in memory, without writing a finished malicious file to disk. Confiant assesses the campaign as active since late 2024, targeting retail traders and cryptocurrency investors across 12 countries in 25 languages, mostly in Asia Pacific and Latin America. The firm says the activity overlaps with a JSCeal campaign described by Bitdefender in September 2025.

Confiant said the SourTrade landing page is technically distinct because it does not distribute finished malware. Instead, it delivers assembly instructions to the victim's browser, retrieves a clean legitimate file from separate infrastructure, and directs the browser to build the final malware in memory on the victim's machine. As a result, no finished malware ever exists on the network.

Check Point said the JSCeal payloads are protected with a tool called javascript-obfuscator. The operators repeatedly use four groups of transformations to hide the malware: they replace function and variable names with short or meaningless identifiers; they split important strings into chunks that are encoded and protected with the RC4 cipher, an older encryption method used to scramble text until the malware needs to read it, then rebuild those strings through decoder functions; they flatten the program flow into a single switch statement controlled by an infinite loop and a state variable; and they pass function calls through proxy helpers while wrapping simple operations such as addition, subtraction, comparison and function invocation in dedicated helper functions.

The Israeli cybersecurity company said it built a fully static deobfuscation pipeline, a set of tools that reverses the obfuscation without running the malicious code, to decode the compiled V8 JavaScript bytecode. That revealed the malware's execution flow and features. Among other things, JSCeal can enumerate installed browsers and query saved secrets, cookies, OAuth tokens, which are digital passes that give an app access to an account without a repeated password, and other data. Router functions inside the malware register handlers for the collected information.

JSCeal's browser stealing module targets a long list of Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Avast Secure Browser, Vivaldi, and Cốc Cốc. For each browser, the malware looks for the expected location of the user data directory, lists available profiles, and extracts cookies and passwords from those profiles. Session cookies are the small pieces of data a website places in a browser to remember that a visitor is already logged in. The researchers say the malware is then equipped to use the stolen cookie data to reconstruct a browser session and carry out active session replay attacks. In such an attack, the stolen session cookie lets the attacker act as the already logged-in user and bypass authentication, gaining unauthorized access to the victim's Google account. A second module gives JSCeal surveillance abilities: it records keystrokes and takes screenshots.

Check Point also found that JSCeal follows a pattern common in banking trojans: it installs a local proxy, a program that sits between the victim's browser and the internet and can see or change web traffic, generates and installs a certificate, and modifies specific web requests and responses. The recovered code shows that this proxy is not limited to passive interception. Dedicated handlers modify selected requests and responses for particular services. One configuration function provides separate overrides for Binance, Bybit, and Ledger, as well as generic handlers for replacing HTML, blocking hosts, and clearing selected cookies. Several other handlers focus on cryptocurrency platforms, and one of them captures account data and records cryptocurrency balances.

Security researcher Aleksandra Doniec, known as Hasherezade, said the recovered code shows two kinds of analysis friction: a version-specific compiled V8 format and several layers of JavaScript obfuscation applied before compilation. Doniec said neither makes the malware impossible to reverse, but together they push it outside the workflows analysts normally rely on. She also said the developments show JSCeal's authors are investing both in making the payload harder to analyze and in broadening its platform coverage, and that with campaigns continuing into recent months, JSCeal remains under active development.

For website owners and IT teams, this research is a practical reminder that browser session cookies are a valuable target for attackers, not just passwords. Because stolen cookies can bypass login pages entirely, password strength alone does not protect an already signed-in account. AEU-I, AEU Group's security-first IT, infrastructure and consulting service, helps organizations review the kinds of endpoint and access controls that reduce this risk.