JSCeal Cryptocurrency Stealer: Check Point Details Static Deobfuscation of Compiled V8 Bytecode Payloads
JSCeal Cryptocurrency Stealer (TL-2026-2259), also tracked as WEEVILPROXY, is a high-severity malware campaign, first published 2026-08-31. It has no confirmed attribution, affects Google Chrome, maps to 19 MITRE ATT&CK techniques (T1010, T1027, T1036.005), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-2259
- Threat ID
- TL-2026-2259
- Also known as
- WEEVILPROXY, MeadowLocust, Spyware.JSCeal
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-31
- Last reviewed
- 2026-08-31
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, cryptocurrency, consumer
- Target regions
- Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in JSCeal Cryptocurrency Stealer
Malware and tooling: MeadowLocust, WEEVILPROXY, Puppeteer, ghost-cursor, javascript-obfuscator, jsc_deobfuscator, tRPC over HTTPS POST / WSS
Check Point Research's "Breaking the Seal" details a static deobfuscation methodology for JSCeal (also tracked as WEEVILPROXY / MeadowLocust), a cryptocurrency-focused stealer active since March 2024 that ships as compiled V8 bytecode (.jsc) inside a bundled Node.js runtime. The malware performs keylogging, browser/credential theft, active session hijacking, and HTTPS interception via a locally installed MITM proxy and root certificate, targeting Chromium browsers, Telegram, and cryptocurrency platforms (Binance, Bybit, Ledger, Phantom) on Windows and macOS.
How JSCeal Cryptocurrency Stealer works
JSCeal is a cryptocurrency-focused information stealer and adversary-in-the-middle toolkit, cross-tracked by other vendors as WEEVILPROXY (WithSecure) and MeadowLocust, that has been active since March 2024 and continuously tracked by Check Point Research since early 2025. Its distinguishing trait is delivery as compiled V8 bytecode (.jsc files) rather than plaintext JavaScript, executed through a bundled Node.js runtime (`node.exe -r preflight.js app.jsc`) rather than a conventional native binary, which historically let hundreds of samples evade signature-based detection on VirusTotal.
The documented delivery chain begins with malvertising (large-scale Facebook ad campaigns using stolen/newly-created accounts) that redirects victims through geolocation- and referrer-filtered landing pages impersonating nearly 50 cryptocurrency exchanges and trading platforms, including TradingView, Binance, and OKX. Victims who pass the filtering are served an MSI installer historically signed with valid certificates belonging to Russian entities; the installer drops DLLs that establish a local HTTP listener, register a scheduled task under SYSTEM privileges for persistence, and add the malware's paths to Windows Defender's exclusion list before staging the final payload as two archives, `node.zip` (a packaged Node.js/V8 runtime) and `build.zip` (the Brotli-compressed `app.jsc` bytecode payload, its `preflight.js` decompression loader, hidden-console helpers `winpty-agent.exe`/`winpty.dll`, and native `.node` PE-format modules).
The `app.jsc` payload itself is protected with four stacked obfuscation layers applied by the `javascript-obfuscator` library: identifier renaming, RC4-encrypted/Base64-encoded string protection reconstructed by decoder functions (averaging roughly 130,000 encrypted string chunks per sample), control-flow flattening into opaque state machines, and proxy/operation indirection that routes function calls and operators through helper wrappers. Check Point's new research describes a fully static deobfuscation pipeline (released as the public `jsc_deobfuscator` tool, built on the View8 V8-bytecode decompiler) that reverses all four layers without dynamic execution: Brotli decompression, bytecode disassembly, value propagation, RC4 string recovery, control-flow unflattening, proxy resolution, operation inlining, and an optional LLM-assisted function-renaming pass (Claude Sonnet 4.6 produced materially more useful labels than GPT-5.4-mini in Check Point's comparison). The pipeline was validated against a fully deobfuscated sample (MD5 e27ae65977287bdfb7b0e15fd3603f85).
Once running, JSCeal's capability set spans browser data theft (extracting the SQLite Cookies and Login Data databases and decrypting secrets protected by both legacy DPAPI and the newer Chromium App-Bound Encryption v10/v11/v20 key formats), active session compromise (using Puppeteer with stealth plugins and ghost-cursor mouse-movement emulation to replay stolen cookies into an automated browser, walk the Google OAuth flow, and mint fresh tokens scoped for `ANDROID` clients), a surveillance module (keylogging, screenshot capture, and window enumeration), and an HTTPS interception capability that generates a self-signed RSA-2048 root certificate, installs it via `certutil -addstore root`, and runs a local MITM proxy on 127.0.0.1 that performs service-specific request/response tampering against Binance, Bybit, and Ledger traffic (including QR-code override). Command and control runs a tRPC router over HTTPS POST and WSS to an `/rpc` endpoint parameterized with `machineId`/`token` values, exchanging binary `application/octet-stream` payloads.
The campaign's scale is significant: Check Point's July 2025 report documented roughly 35,000 malicious Facebook ads served across the EU in H1 2025 alone (an estimated 3.5 million EU impressions, with potential global exposure exceeding 10 million users), and WithSecure independently corroborated overlapping infrastructure under the name WeevilProxy, indicating multi-vendor visibility into the same cluster. No CVE or vendor patch applies, since the threat is entirely social-engineering- and behavior-driven rather than vulnerability-driven; defense depends on detecting the Node.js-bytecode execution pattern, root-certificate installation, and anomalous local-proxy/scheduled-task artifacts described above.
MITRE ATT&CK techniques used in TL-2026-2259
Discovery
T1010 Application Window Discovery; T1082 System Information Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
Persistence
Collection
T1056.001 Keylogging; T1113 Screen Capture
Command and Control
Execution
T1129 Shared Modules; T1204.002 Malicious File
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers; T1557 Adversary-in-the-Middle
defense-impairment
T1553.004 Install Root Certificate; T1685 Disable or Modify Tools
Resource Development
Affected products and versions in JSCeal Cryptocurrency Stealer
- Google — Chrome
Vulnerable versions: all versions targeted for credential/cookie theft - Microsoft — Edge
Vulnerable versions: all versions targeted for credential/cookie theft - Telegram — Telegram Desktop
Vulnerable versions: session data targeted for theft - Binance — Binance web/desktop platform
Vulnerable versions: targeted by service-specific local-proxy tampering - Ledger — Ledger Live
Vulnerable versions: targeted by service-specific local-proxy tampering - Phantom — Phantom Wallet browser extension
Vulnerable versions: targeted for credential/session theft
Remediation for JSCeal Cryptocurrency Stealer
Immediate actions
- Alert on node.exe processes invoked with a .jsc file argument or a '-r preflight.js' flag outside sanctioned developer/build environments
- Alert on certutil.exe invoked with '-addstore root' outside authorized IT certificate-deployment workflows
- Block or quarantine MSI packages downloaded from ad-referral chains, especially those signed by unfamiliar or foreign publishers
- Monitor for new processes binding local HTTP/HTTPS listeners on 127.0.0.1 (e.g. port 30303) shortly after an MSI installation
Workarounds
- Audit installed root/trusted CA certificates and remove any not deployed through sanctioned PKI processes
- Audit Scheduled Tasks running under SYSTEM and remove any not deployed by IT, particularly ones referencing PowerShell or unfamiliar DLLs
Longer-term hardening
- Deploy EDR behavioral detection for non-browser process access to Chromium 'Login Data' and 'Cookies' SQLite databases
- Monitor for anomalous DPAPI master-key or App-Bound Encryption key access outside the owning browser process
- Educate cryptocurrency-platform users to install trading/wallet apps only from official app stores or vendor-verified domains, never from ad-referred landing pages
- Add network egress monitoring for anomalous outbound wss:// and '/rpc'-suffixed endpoints originating from consumer endpoints
Timeline of JSCeal Cryptocurrency Stealer
- JSCeal (later cross-tracked by other vendors as WEEVILPROXY / MeadowLocust) is first observed distributing compiled V8 bytecode (.jsc) payloads via a bundled Node.js runtime against cryptocurrency-focused victims.
- Check Point Research begins continuous tracking of the JSCeal cluster after identifying a recurring malvertising-to-Node.js delivery pattern.
- Microsoft documents related malvertising activity delivering the same Node.js/V8-bytecode payload chain, per subsequent secondary reporting.
- Check Point discloses that JSCeal-linked malvertising served roughly 35,000 malicious Facebook advertisements across the EU during January-June 2025, generating an estimated 3.5 million EU impressions and a potential global reach exceeding 10 million users.
- Check Point Research publishes 'Sealed Chain of Deception,' the first detailed public technical report on JSCEAL, documenting the malvertising-to-MSI-to-Node.js delivery chain, the local adversary-in-the-middle proxy, and impersonation of nearly 50 cryptocurrency trading platforms.
- WithSecure independently publishes analysis of overlapping activity under the name 'WeevilProxy,' confirming multi-vendor visibility into the same malware cluster.
- KPMG's Cyber Threat Intelligence Platform circulates a summarized JSCEAL threat brief to enterprise customers, reflecting continued analyst interest in the campaign.
- Check Point Research publishes 'Breaking the Seal,' detailing a static deobfuscation methodology for JSCeal's compiled V8 bytecode via the public jsc_deobfuscator toolkit, including a fully deobfuscated reference sample (MD5 e27ae65977287bdfb7b0e15fd3603f85), and presents the research at Black Hat USA 2026.
Sources cited for JSCeal Cryptocurrency Stealer
- Breaking the Seal: Static Deobfuscation of JSCeal's Compiled V8 Bytecode
- jsc_deobfuscator (View8-based deobfuscation tooling)
- Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCEAL
- New JSCEAL Malware Targets Crypto App Users
- Hackers Use Facebook Ads to Spread JSCEAL Malware via Fake Crypto Apps
- New JSCEAL Attack Aims to Steal Credentials and Wallets from Crypto Users
- Cato CTRL Threat Research: A Deep Dive into a New JSCEAL Infostealer Campaign
- Spyware.JSCeal Threat Detection
- KPMG CTIP: JSCEAL Threat Intelligence Brief
More in malware
- Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns
- Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator GitHub Repos
- EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials
- Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoors
- PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography for Stealth C2
Detection coverage for TL-2026-2259
As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2259 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.