JSCeal is a Node.js-based stealer delivered as compiled V8 bytecode that targets browser credentials, cryptocurrency wallets, and Telegram sessions. The malware implements a local HTTPS interception proxy with attacker-controlled certificate installation, modifies responses for cryptocurrency platforms, and uses Puppeteer to automate Google OAuth token theft. Check Point Research developed a static deobfuscation pipeline extending the View8 decompiler to recover readable pseudocode from the obfuscated V8 bytecode, enabling analysis of the malware's full capability set.
V8 Bytecode
2 posts
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - Check Point Research Day 2 at Black Hat: Check Point Research Takes the Stage Check Point Research presented three talks at Black Hat covering: (1) a Windows Defender kernel driver (BTR) with a hardcoded encryption key across all signed builds spanning Windows 7–11 25H2, enabling arbitrary Ring 0 operations with no CVE or patch; (2) twelve CVEs across four major AI agent frameworks where poisoned content triggers exploitation through framework serialization and caching internals without direct tool invocation; and (3) a deobfuscation pipeline for JSCeal, a V8 bytecode-compiled cryptocurrency stealer whose payloads include credential theft, keylogging, and HTTPS interception.