JSCeal Cryptocurrency Stealer: Check Point Details Static Deobfuscation of Compiled V8 Bytecode Payloads

Key facts for JSCeal Node.js crypto stealer

Detection coverage for JSCeal Node.js crypto stealer

As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2259 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: JSCeal Node.js V8 Bytecode Payload Execution (node.exe -r preflight.js app.jsc)

Detects the bundled Node.js runtime being invoked with the '-r preflight.js' loader flag against the Brotli-compressed compiled V8 bytecode payload 'app.jsc' — JSCeal's distinguishing execution pattern that historically evaded signature-based AV because the payload never ships as plaintext JavaScript or a native PE. Fires on the initial-access/execution stage after the MSI installer stages node.zip/build.zip.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1129, T1027
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

`comment("Detects node.exe executing preflight.js loader against compiled V8 bytecode payload app.jsc - JSCeal/WEEVILPROXY/MeadowLocust delivery pattern")`
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(lower(Image), "\\\\node\.exe$") OR match(lower(OriginalFileName), "node\.exe")
| where match(lower(CommandLine), "preflight\.js") AND match(lower(CommandLine), "app\.jsc")
| eval mitre_technique="T1204.002,T1129,T1027"
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName, User, Image, ParentImage, CommandLine
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table ComputerName, User, Image, ParentImage, CommandLine, count, first_seen, last_seen, mitre_technique
| sort -last_seen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "node.exe"
| where ProcessCommandLine has "preflight.js" and ProcessCommandLine has "app.jsc"
| extend MitreTechniques = "T1204.002,T1129,T1497"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, MitreTechniques
| order by Timestamp desc

Sigma

title: Node.js Runtime Executing Compiled V8 Bytecode Payload (JSCeal Pattern)
id: 7c2f9a1e-4b3d-4e6a-9f0d-1a2b3c4d5e6f
status: experimental
description: Detects node.exe invoked with the preflight.js loader against a compiled V8 bytecode file named app.jsc, the JSCeal/WEEVILPROXY/MeadowLocust cryptocurrency-stealer execution pattern documented by Check Point Research.
references:
  - https://research.checkpoint.com/2026/breaking-the-seal-static-deobfuscation-of-jsceals-compiled-v8-bytecode/
  - https://research.checkpoint.com/2025/jsceal-targets-crypto-apps/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-31
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1129
  - attack.defense_evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\node.exe'
  selection_cli:
    CommandLine|contains|all:
      - 'preflight.js'
      - 'app.jsc'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate Node.js developers running a script literally named preflight.js against a file literally named app.jsc (rare naming collision in sanctioned dev/build environments)
level: high

Known false positives:

• Sanctioned developer or CI/build environments that legitimately name a loader script 'preflight.js' and a bytecode artifact 'app.jsc' — scope by excluding known build-server hostnames/paths

Tuning notes: Exclude sanctioned CI/build hosts by ComputerName/DeviceName allowlist; widen matching to '-r preflight.js' as a distinct token pair rather than substring if false positives appear from unrelated Node tooling.

• 🔒 JSCeal Compiled Bytecode Loader Execution via Node.js Runtime · unlock with TL Creds
• 🔒 JSCeal SYSTEM-Level Scheduled Task and Root Certificate Persistence · unlock with TL Creds
• 🔒 Non-Browser Process Access to Chromium Login Data/Cookies Databases (JSCeal Credential Theft) · unlock with TL Creds
• 🔒 Node.js Runtime Executing Compiled V8 Bytecode Payload (JSCeal Pattern) · unlock with TL Creds
• 🔒 JSCeal Persistence via SYSTEM Scheduled Task and Windows Defender Exclusion · unlock with TL Creds
• 🔒 JSCeal Local MITM Proxy Listener and /rpc C2 Network Beacon · unlock with TL Creds
• 🔒 JSCeal Persistence and Defense-Evasion Chain (SYSTEM Scheduled Task + Root Cert + Defender Exclusion) · unlock with TL Creds
• 🔒 JSCeal Local AitM Proxy and tRPC C2 Callback (incl. Malvertising Infrastructure) · unlock with TL Creds

Indicators of compromise for JSCeal Node.js crypto stealer

As of 2026-08-31, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-2259.

Sample indicators (3 of 22)

• IP address: 1.1.1[.]1
• File hash: e27ae65977287bdfb7b0e15fd3603f85
• IP address: 8.8.8[.]8

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

How JSCeal Node.js crypto stealer works

JSCeal is a cryptocurrency-focused information stealer and adversary-in-the-middle toolkit, cross-tracked by other vendors as WEEVILPROXY (WithSecure) and MeadowLocust, that has been active since March 2024 and continuously tracked by Check Point Research since early 2025. Its distinguishing trait is delivery as compiled V8 bytecode (.jsc files) rather than plaintext JavaScript, executed through a bundled Node.js runtime (`node.exe -r preflight.js app.jsc`) rather than a conventional native binary, which historically let hundreds of samples evade signature-based detection on VirusTotal.

The documented delivery chain begins with malvertising (large-scale Facebook ad campaigns using stolen/newly-created accounts) that redirects victims through geolocation- and referrer-filtered landing pages impersonating nearly 50 cryptocurrency exchanges and trading platforms, including TradingView, Binance, and OKX. Victims who pass the filtering are served an MSI installer historically signed with valid certificates belonging to Russian entities; the installer drops DLLs that establish a local HTTP listener, register a scheduled task under SYSTEM privileges for persistence, and add the malware's paths to Windows Defender's exclusion list before staging the final payload as two archives, `node.zip` (a packaged Node.js/V8 runtime) and `build.zip` (the Brotli-compressed `app.jsc` bytecode payload, its `preflight.js` decompression loader, hidden-console helpers `winpty-agent.exe`/`winpty.dll`, and native `.node` PE-format modules).

The `app.jsc` payload itself is protected with four stacked obfuscation layers applied by the `javascript-obfuscator` library: identifier renaming, RC4-encrypted/Base64-encoded string protection reconstructed by decoder functions (averaging roughly 130,000 encrypted string chunks per sample), control-flow flattening into opaque state machines, and proxy/operation indirection that routes function calls and operators through helper wrappers. Check Point's new research describes a fully static deobfuscation pipeline (released as the public `jsc_deobfuscator` tool, built on the View8 V8-bytecode decompiler) that reverses all four layers without dynamic execution: Brotli decompression, bytecode disassembly, value propagation, RC4 string recovery, control-flow unflattening, proxy resolution, operation inlining, and an optional LLM-assisted function-renaming pass (Claude Sonnet 4.6 produced materially more useful labels than GPT-5.4-mini in Check Point's comparison). The pipeline was validated against a fully deobfuscated sample (MD5 e27ae65977287bdfb7b0e15fd3603f85).

Once running, JSCeal's capability set spans browser data theft (extracting the SQLite Cookies and Login Data databases and decrypting secrets protected by both legacy DPAPI and the newer Chromium App-Bound Encryption v10/v11/v20 key formats), active session compromise (using Puppeteer with stealth plugins and ghost-cursor mouse-movement emulation to replay stolen cookies into an automated browser, walk the Google OAuth flow, and mint fresh tokens scoped for `ANDROID` clients), a surveillance module (keylogging, screenshot capture, and window enumeration), and an HTTPS interception capability that generates a self-signed RSA-2048 root certificate, installs it via `certutil -addstore root`, and runs a local MITM proxy on 127.0.0.1 that performs service-specific request/response tampering against Binance, Bybit, and Ledger traffic (including QR-code override). Command and control runs a tRPC router over HTTPS POST and WSS to an `/rpc` endpoint parameterized with `machineId`/`token` values, exchanging binary `application/octet-stream` payloads.

The campaign's scale is significant: Check Point's July 2025 report documented roughly 35,000 malicious Facebook ads served across the EU in H1 2025 alone (an estimated 3.5 million EU impressions, with potential global exposure exceeding 10 million users), and WithSecure independently corroborated overlapping infrastructure under the name WeevilProxy, indicating multi-vendor visibility into the same cluster. No CVE or vendor patch applies, since the threat is entirely social-engineering- and behavior-driven rather than vulnerability-driven; defense depends on detecting the Node.js-bytecode execution pattern, root-certificate installation, and anomalous local-proxy/scheduled-task artifacts described above.

MITRE ATT&CK techniques by tactic:

Discovery

T1010 Application Window Discovery; T1082 System Information Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Persistence

T1053.005 Scheduled Task

Collection

T1056.001 Keylogging; T1113 Screen Capture

Command and Control

T1071.001 Web Protocols

Execution

T1129 Shared Modules; T1204.002 Malicious File

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers; T1557 Adversary-in-the-Middle

defense-impairment

T1553.004 Install Root Certificate; T1685 Disable or Modify Tools

Resource Development

T1583.001 Domains; T1583.008 Malvertising

Remediation for JSCeal Node.js crypto stealer

Immediate actions

• Alert on node.exe processes invoked with a .jsc file argument or a '-r preflight.js' flag outside sanctioned developer/build environments
• Alert on certutil.exe invoked with '-addstore root' outside authorized IT certificate-deployment workflows
• Block or quarantine MSI packages downloaded from ad-referral chains, especially those signed by unfamiliar or foreign publishers
• Monitor for new processes binding local HTTP/HTTPS listeners on 127.0.0.1 (e.g. port 30303) shortly after an MSI installation

Workarounds

• Audit installed root/trusted CA certificates and remove any not deployed through sanctioned PKI processes
• Audit Scheduled Tasks running under SYSTEM and remove any not deployed by IT, particularly ones referencing PowerShell or unfamiliar DLLs

Longer-term hardening

• Deploy EDR behavioral detection for non-browser process access to Chromium 'Login Data' and 'Cookies' SQLite databases
• Monitor for anomalous DPAPI master-key or App-Bound Encryption key access outside the owning browser process
• Educate cryptocurrency-platform users to install trading/wallet apps only from official app stores or vendor-verified domains, never from ad-referred landing pages
• Add network egress monitoring for anomalous outbound wss:// and '/rpc'-suffixed endpoints originating from consumer endpoints

Affected and fixed versions

• Google — Chrome
  Vulnerable versions: all versions targeted for credential/cookie theft
• Microsoft — Edge
  Vulnerable versions: all versions targeted for credential/cookie theft
• Telegram — Telegram Desktop
  Vulnerable versions: session data targeted for theft
• Binance — Binance web/desktop platform
  Vulnerable versions: targeted by service-specific local-proxy tampering
• Ledger — Ledger Live
  Vulnerable versions: targeted by service-specific local-proxy tampering
• Phantom — Phantom Wallet browser extension
  Vulnerable versions: targeted for credential/session theft

Timeline of JSCeal Node.js crypto stealer

• 2024-03-01 locked-ioc-20 (later cross-tracked by other vendors as locked-ioc-10 / locked-ioc-6) is first observed distributing compiled V8 bytecode (.jsc) payloads via a bundled Node.js runtime against cryptocurrency-focused victims.
• 2025-02-01 Check Point Research begins continuous tracking of the locked-ioc-20 cluster after identifying a recurring malvertising-to-Node.js delivery pattern.
• 2025-04-01 Microsoft documents related malvertising activity delivering the same Node.js/V8-bytecode payload chain, per subsequent secondary reporting.
• 2025-06-30 Check Point discloses that JSCeal-linked malvertising served roughly 35,000 malicious Facebook advertisements across the EU during January-June 2025, generating an estimated 3.5 million EU impressions and a potential global reach exceeding 10 million users.
• 2025-07-01 Check Point Research publishes 'Sealed Chain of Deception,' the first detailed public technical report on locked-ioc-20, documenting the malvertising-to-MSI-to-Node.js delivery chain, the local adversary-in-the-middle proxy, and impersonation of nearly 50 cryptocurrency trading platforms.
• 2025-07-15 WithSecure independently publishes analysis of overlapping activity under the name 'locked-ioc-10,' confirming multi-vendor visibility into the same malware cluster.
• 2025-08-19 KPMG's Cyber Threat Intelligence Platform circulates a summarized locked-ioc-20 threat brief to enterprise customers, reflecting continued analyst interest in the campaign.
• 2026-08-31 Check Point Research publishes 'Breaking the Seal,' detailing a static deobfuscation methodology for locked-ioc-20's compiled V8 bytecode via the public locked-ioc-5 toolkit, including a fully deobfuscated reference sample (MD5 locked-ioc-1), and presents the research at Black Hat USA 2026.

Sources cited for JSCeal Node.js crypto stealer

• KPMG CTIP: JSCEAL Threat Intelligence Brief assets.kpmg.com · Advisory · 2025-08-19
• Breaking the Seal: Static Deobfuscation of JSCeal's Compiled V8 Bytecode Check Point Research · Research · 2026-08-31
• Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCEAL Check Point Research · Research · 2025-07-01
• Cato CTRL Threat Research: A Deep Dive into a New JSCEAL Infostealer Campaign catonetworks.com · Vendor report · 2025-07-01
• Spyware.JSCeal Threat Detection threatdown.com · Vendor report
• jsc_deobfuscator (View8-based deobfuscation tooling) GitHub · Code repository
• New JSCEAL Malware Targets Crypto App Users Check Point · Blog · 2025-07-01
• Hackers Use Facebook Ads to Spread JSCEAL Malware via Fake Crypto Apps The Hacker News · News · 2025-07-01
• New JSCEAL Attack Aims to Steal Credentials and Wallets from Crypto Users gbhackers.com · News · 2025-07-01

Threats related to JSCeal Node.js crypto stealer

• Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware
• Infostealer Malware Hijacks Claude Login Sessions to Bypass MFA and Drain Usage; Related FakeAgent Malvertising Campaign Deploys SectopRAT via Trojanized Claude Desktop Installer
• SourTrade Malvertising Campaign Assembles Windows Malware In-Browser via ServiceWorker/SharedWorker JavaScript Chain to Defeat Hash-Based Detection
• MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop (hVNC) to Hijack Live Browser Sessions and Steal Credentials
• SnappyClient RAT — C++ C2 Implant Delivered via HijackLoader (Operation Turb00 Part 3)

Related coverage of this activity

• NULLZEREPTOOL Telegram DDoS framework
• Sable Squirrel dropcatch campaign
• GTA VI pre-release domain abuse
• AI brand impersonation campaign
• Fake Codex ClickFix Atomic Stealer

Previous and next in malware

• Commodity Infostealers Hijack Authenticated Claude Sessions to Drain Usage and Payment Methods Previous report
• TerminalFix Campaign Deploys Custom Python Reverse-Tunnel Implant via Fake Cloudflare CAPTCHA, DLL Sideloading, and PNG Steganography Next report