JSCEAL is a cryptocurrency stealer that Check Point Research has tracked since early 2025. The malware hides its code by compiling JavaScript into V8 bytecode (.jsc) and bundling a Node[.]js runtime to execute it, so the victim never runs ordinary JavaScript. Before compilation, the source is heavily obfuscated, with names replaced by meaningless strings and important text split into encrypted chunks. The result is a version-specific, largely opaque payload that defeats standard JavaScript deobfuscation tools.
Researchers demonstrated a deobfuscation pipeline built on an extension of View8, an open‑source V8 bytecode decompiler. By applying a multi-layer process in a strict sequence, they could recover readable code from 23 JSCeal samples. The recovered code reveals a broad toolkit for financial theft: it steals saved passwords and cookies from eight Chromium-based browsers, harvests Telegram session data, logs keystrokes, takes screenshots, and installs a locally generated certificate to intercept HTTPS traffic.
The proxy can actively modify specific requests and responses for services such as Binance, Bybit and Ledger, enabling credential theft and even replacing legitimate site content.
The malware also supports more active credential replay by injecting stolen session cookies into the browser’s authentication flow to obtain fresh OAuth tokens. Newer samples added AES-256-CBC encryption around the compressed payload with a key supplied via an environment variable, complicating analysis. The authors have extended targeting to macOS and updated the Node[.]js runtime accordingly.
The technique—combining layered obfuscation, V8 bytecode, and a deployable proxy—means JSCeal remains a developing threat for crypto platforms and browser-based assets.