10 minhigh
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - Check Point Research
JSCeal is a Node.js-based stealer delivered as compiled V8 bytecode that targets browser credentials, cryptocurrency wallets, and Telegram sessions. The malware implements a local HTTPS interception proxy with attacker-controlled certificate installation, modifies responses for cryptocurrency platforms, and uses Puppeteer to automate Google OAuth token theft. Check Point Research developed a static deobfuscation pipeline extending the View8 decompiler to recover readable pseudocode from the obfuscated V8 bytecode, enabling analysis of the malware's full capability set.
Sens:▲ 24h
Showing defanged values
- domainiapi[.]kraken[.]comKraken API endpoint intercepted by JSCeal's local proxy for balance history theft
- domainresources[.]live[.]ledger[.]appLedger resource domain intercepted by JSCeal's proxy; analytics.min.js path is replaced with attacker-controlled script
- filenameAppData\Local\Google\Chrome\UserDataChrome user data directory targeted by JSCeal for credential and cookie theft
- filenameapp.jscJSCeal malware payload distributed as Brotli-compressed V8 bytecode; renamed to app.js in later campaigns
- filenamepreflight.jsDecompression script that unpacks the Brotli-compressed JSCeal payload before loading; renamed to preload.js in later campaigns
- filename<profile>\LoginDataChromium login data SQLite database path queried by JSCeal for credential extraction
- filename<profile>\Network\CookiesChromium cookies SQLite database path queried by JSCeal
- filenamewinpty-agent.exeAgent for a hidden Windows console bundled with JSCeal; open-source tool used by the malware
- filenamewinpty.dllModule allowing interaction with the hidden console, bundled alongside the JSCeal payload
- md50d1fce0cb2b9dec26a10f0822aeffb19MD5 of the last observed JSCeal payload using V8 10.2.154.26-node.25
- md5581e2e2265d0c1509b3799c5a9039374First observed JSCeal payload with AES-256-CBC encryption layer, generated 2025-11-11
- md5de10c6b3dc4619f59bc9c80a0aa15e6aJSCeal payload from a campaign targeting macOS
- md5e27ae65977287bdfb7b0e15fd3603f85MD5 of the JSCeal payload used as the primary case study in the article
- sha2565b4edd9bffdd7909b8b432eacd463d59eb23eba151c9e218161ab15dd72d55edSHA256 of the last observed JSCeal payload using V8 10.2.154.26-node.25, associated with campaigns starting end of October 2025
- sha256b73c3d732bb6bff8b9088cc0dcbadb35eea0802056324f1b6295cb9277c62755SHA256 of the JSCeal payload used as the primary case study in the article
- urlhxxps://accounts[.]google[.]com/o/android/auth?return_user_id=trueGoogle Android authentication endpoint targeted by JSCeal's Puppeteer-based OAuth token theft workflow
- urlhxxps://github[.]com/hasherezade/jsc_deobfuscatorPublic deobfuscation toolkit released by researchers for analyzing JSCeal V8 bytecode payloads
Detection / Hunteropenrouter
What Happened
A malware called JSCeal steals passwords, browser cookies, and cryptocurrency wallet data from infected computers. It is delivered as compiled code that is hard for security analysts to read, because the attackers use multiple layers of obfuscation before compiling it. The malware can also set up a local proxy server to intercept and modify web traffic for cryptocurrency websites, and it can automatically log into Google accounts using stolen cookies to obtain new authentication tokens. Researchers at Check Point built a toolkit to decode this obfuscated code and published it openly. Organizations should check their systems for the indicators described in the article, ensure browser data is protected, and educate users about malvertising as the initial infection vector.
Key Takeaways
- JSCeal is a stealer delivered as compiled V8 bytecode (.jsc) executed by a bundled Node.js runtime, targeting cryptocurrency applications and browser credentials.
- The malware implements a local HTTPS interception proxy with self-signed certificate installation, capable of modifying requests and responses for Binance, Bybit, and Ledger.
- JSCeal uses Puppeteer with stealth plugins to replay stolen browser cookies against Google's Android authentication endpoint, obtaining fresh OAuth tokens.
- The payload uses layered obfuscation: javascript-obfuscator applied before V8 compilation, including RC4-encrypted string chunks, control-flow flattening, and proxy indirection.
- Recent campaigns (November 2025) added AES-256-CBC encryption around the Brotli-compressed payload, with the key supplied by an earlier deployment stage via environment variable.
Affected Systems
- Windows systems with Chromium-based browsers (Chrome, Edge, Brave, Opera, Opera GX, Avast Secure Browser, Vivaldi, Cốc Cốc)
- macOS systems (observed in recent campaigns)
- Users of cryptocurrency platforms (Binance, Bybit, Kraken, OKX, KuCoin, Ledger, and others)
- Telegram desktop users
- Systems with Node.js runtime bundled in the malware package
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Malvertising leads to multiple PowerShell scripts that download two ZIP archives containing the Node.js runtime and JSCeal payload components
- Execution: PowerShell launches bundled node.exe with preflight.js decompression script and app.jsc payload (node.exe -r preflight.js app.jsc)
- Defense Evasion: Payload is Brotli-compressed V8 bytecode with javascript-obfuscator layers (RC4 string encryption, control-flow flattening, proxy indirection); later versions add AES-256-CBC encryption
- Collection: Malware enumerates installed Chromium-based browsers, extracts cookies, passwords, and OAuth tokens from SQLite databases; decrypts v10/v11/v20 encrypted values using DPAPI and App-Bound keys
- Credential Theft: Puppeteer with stealth plugins replays stolen cookies against Google Android auth endpoint to obtain fresh OAuth tokens
- Exfiltration: Stolen data sent via HTTP POST (application/octet-stream) or WebSocket to attacker C2 at https://api.<domain>/rpc or wss://api.<domain>/rpc with machineId and token parameters
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: jsc_deobfuscator (GitHub), jsceal_datasets (GitHub)
No detection rules are provided in the article. The researchers released a static deobfuscation toolkit and extracted string listings from 24 analyzed samples on GitHub, which can be used to derive signatures.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can observe node.exe spawning from PowerShell, certutil adding root certificates, and child process creation patterns. However, the malware's internal logic (cookie extraction, OAuth replay, proxy interception) runs within the Node.js process and may not produce distinct process-level telemetry. |
| Network Visibility | Medium | Network monitoring can detect connections to api.<domain>/rpc endpoints, local proxy traffic on 127.0.0.1, and DNS queries to hardcoded resolvers 1.1.1.1 and 8.8.8.8. HTTPS interception proxy traffic may be visible if egress inspection is in place. |
| Detection Difficulty | Hard | The payload is compiled V8 bytecode with no readable JavaScript source, making static signature generation difficult. The malware uses legitimate Node.js processes and open-source tools. Certificate installation via certutil is a known pattern but may be missed if not specifically monitored. Browser database access occurs within the same process context. |
Required Log Sources
- Process creation logs (Sysmon Event ID 1 / Windows Security 4688)
- Certificate store modification logs
- DNS query logs
- File system access logs for browser profile directories
- Network connection logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for node.exe processes spawned by PowerShell with command-line arguments referencing .jsc or .js files, as this indicates JSCeal payload execution. | Process creation events with parent-child relationship analysis | Execution | Medium — legitimate Node.js applications may be launched from scripts, but the specific -r flag pattern with app.jsc is distinctive |
| Consider hunting for certutil.exe invocations with -addstore arguments targeting the root certificate store, as JSCeal installs an attacker-controlled root certificate. | Process creation events, command-line logging | Persistence | Low — certutil -addstore root is rarely used by legitimate software in typical enterprise environments |
| Consider hunting for node.exe processes making outbound HTTPS connections to URLs containing /rpc paths with machineId and token query parameters, as this matches JSCeal's C2 communication pattern. | Network connection logs, proxy logs, DNS resolution logs | Exfiltration | Medium — legitimate RPC-style APIs exist, but the combination of node.exe as the source process and the specific parameter pattern is unusual |
| Consider hunting for processes accessing Chromium browser SQLite databases (Network\Cookies, Login Data) outside of the browser process itself, as JSCeal reads these files directly. | File access monitoring, Sysmon Event ID 11 (FileCreate) or Event ID 1 with file access correlation | Collection | Medium — some legitimate security tools and browser extensions may access these files |
| Consider hunting for node.exe spawning browser processes with --user-data-dir and --profile-directory arguments, as JSCeal launches installed browsers via Puppeteer for OAuth token theft. | Process creation events with command-line logging | Credential Theft | Low to Medium — automated browser testing frameworks use similar patterns but are typically confined to development environments |
Control Gaps
- Standard JavaScript deobfuscation tools cannot process compiled V8 bytecode format
- EDR may not inspect intra-process Node.js API calls for file and database access
- Local HTTPS proxy traffic on 127.0.0.1 may bypass network security monitoring
- Browser credential decryption using DPAPI and App-Bound keys occurs in-process and may not trigger alerts
- Puppeteer-based browser automation with stealth plugins may evade bot detection on authentication endpoints
Key Behavioral Indicators
- node.exe process launched from PowerShell with -r flag and .jsc/.js file arguments
- certutil.exe with -addstore -f root arguments
- node.exe making POST requests with application/octet-stream content-type to /rpc endpoints
- Browser processes (chrome.exe, msedge.exe, etc.) spawned by node.exe with --user-data-dir arguments
- winpty-agent.exe and winpty.dll present in the same directory as node.exe and app.jsc/app.js
- DNS resolver configuration changed to 1.1.1.1 and 8.8.8.8 via Node.js dns module
False Positive Assessment
Medium — JSCeal uses legitimate open-source tools (Node.js, winpty, Puppeteer) and standard Windows utilities (certutil, PowerShell). Individual behaviors may appear in development or testing environments. Correlation across multiple indicators (node.exe from PowerShell, certutil root store modification, browser database access, /rpc endpoint communication) significantly reduces false positive risk.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching endpoint telemetry for node.exe processes launched by PowerShell with .jsc or .js file arguments, as this is the primary execution indicator for JSCeal.
- Consider hunting for certutil.exe executions with -addstore arguments targeting the root certificate store across your endpoint estate, and investigate any unexpected root certificates added recently.
- If your EDR supports it, consider blocking or alerting on node.exe making outbound connections to URLs containing /rpc paths with machineId and token query parameters.
- Consider reviewing DNS logs for systems where the Node.js dns.setServers API was used to configure 1.1.1.1 and 8.8.8.8 as resolvers.
Infrastructure Hardening
- Evaluate whether your web filtering or proxy infrastructure can detect and block outbound application/octet-stream POST requests from node.exe processes to unknown API endpoints.
- Consider implementing certificate pinning or monitoring for unexpected root certificate additions on endpoint systems.
- If applicable, evaluate whether browser profile directories can be protected with application control to prevent access by non-browser processes.
- Consider monitoring for Puppeteer or puppeteer-extra package usage in non-development environments.
User Protection
- Consider deploying endpoint detection rules for unauthorized browser automation, particularly processes launching browsers with --user-data-dir arguments from non-browser parent processes.
- Evaluate whether your organization's browser management policy can enforce App-Bound encryption for Chromium browser data where supported.
- Consider enabling enhanced protection features in managed browser deployments to detect cookie replay attacks against Google authentication endpoints.
Security Awareness
- Consider incorporating malvertising awareness into existing security training programs, as JSCeal campaigns begin with malicious advertisements.
- Educate users on the risks of unauthorized Node.js runtime executions and the importance of reporting unexpected browser launches or certificate installation prompts.
- If applicable, remind cryptocurrency platform users in your organization about the risk of session hijacking on exchange platforms and the importance of hardware wallet usage.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping18 techniques
Tactic
Execution
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Domains:
iapi[.]kraken[.]com- Kraken API endpoint intercepted by JSCeal's local proxy for balance history theftresources[.]live[.]ledger[.]app- Ledger resource domain intercepted by JSCeal's proxy; analytics.min.js path is replaced with attacker-controlled script
- File Hashes:
581e2e2265d0c1509b3799c5a9039374(MD5) - First observed JSCeal payload with AES-256-CBC encryption layer, generated 2025-11-11de10c6b3dc4619f59bc9c80a0aa15e6a(MD5) - JSCeal payload from a campaign targeting macOS
- File Paths:
AppData\Local\Google\Chrome\User Data- Chrome user data directory targeted by JSCeal for credential and cookie theft<profile>\Network\Cookies- Chromium cookies SQLite database path queried by JSCeal<profile>\Login Data- Chromium login data SQLite database path queried by JSCeal for credential extraction
- Command Lines:
- Purpose: Launch JSCeal payload via bundled Node.js runtime with preflight decompression script | Tools:
node.exe,preflight.js,app.jsc| Stage: Execution |node.exe -r .\preflight.js .\app.jsc - Purpose: Install attacker-generated root certificate into Windows certificate store | Tools:
certutil| Stage: Persistence / Proxy Setup |certutil -addstore -f root <tempfile> - Purpose: Deploy hidden PowerShell scripts and execute Base64-encoded content | Tools:
powershell.exe| Stage: Execution |powershell -NoProfile -WindowStyle Hidden -Command "
- Purpose: Launch JSCeal payload via bundled Node.js runtime with preflight decompression script | Tools:
- Other:
1.1.1.1- DNS resolver hardcoded by JSCeal via dns.setServers8.8.8.8- DNS resolver hardcoded by JSCeal via dns.setServers127.0.0.1- Local proxy server address used by JSCeal for HTTPS interception
