Security researchers at Check Point and Confiant have published detailed analyses of JSCeal, a sophisticated infostealer that has been active since late 2024. The malware targets retail traders and cryptocurrency investors across 12 countries and 25 languages — primarily in the Asia-Pacific and Latin America regions. It arrives via malvertising campaigns that deliver a PowerShell payload, then install a local Node.js runtime to run the main malicious script.
What sets JSCeal apart is its session-replay capability: after stealing browser cookies from Chromium-based browsers (Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, and others), the malware reconstructs a full browser session and uses those cookies to log into the victim’s Google account without needing a password or triggering two-factor authentication. A built-in local proxy intercepts and modifies web traffic for specific cryptocurrency platforms — Binance, Bybit, and Ledger each have dedicated handlers that can alter transaction details, capture account balances, and clear selected cookies. A keylogger and screenshot module run alongside the main stealer. Check Point researcher Aleksandra “Hasherezade” Doniec notes that JSCeal combines compiled V8 bytecode with multiple layers of JavaScript obfuscation to frustrate analysis, and that the malware is under active development with new capabilities added in recent months. The campaign overlaps with the separately documented SourTrade operation, which assembles malware entirely in the victim’s browser memory to avoid leaving a finished payload on the network.