JSCeal Cryptocurrency Stealer: Check Point Details Static Deobfuscation of Compiled V8 Bytecode Payloads — Threadlinqs Intelligence
As of 2026-08-31, JSCeal Cryptocurrency Stealer: Check Point Details Static Deobfuscation of Compiled V8 Bytecode Payloads is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-2259 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Check Point Research's "Breaking the Seal" details a static deobfuscation methodology for JSCeal (also tracked as WEEVILPROXY / MeadowLocust), a cryptocurrency-focused stealer active since March 2024
JSCeal is a cryptocurrency-focused information stealer and adversary-in-the-middle toolkit, cross-tracked by other vendors as WEEVILPROXY (WithSecure) and MeadowLocust, that has been active since March 2024 and continuously tracked by Check Point Research since early 2025. Its distinguishing trait is delivery as compiled V8 bytecode (.jsc files) rather than plaintext JavaScript, executed through a bundled Node.js runtime (`node.exe -r preflight.js app.jsc`) rather than a conventional native binary, which historically let hundreds of samples evade signature-based detection on VirusTotal.
The documented delivery chain begins with malvertising (large-scale Facebook ad campaigns using stolen/newly-created accounts) that redirects victims through geolocation- and referrer-filtered landing pages impersonating nearly 50 cryptocurrency exchanges and trading platforms, including TradingView, Binance, and OKX. Victims who pass the filtering are served an MSI installer historically signed with valid certificates belonging to Russian entities; the installer drops DLLs that establish a local HTTP listener, register a scheduled task under SYSTEM privileges for persistence, and add the malware's paths to Windows Defender's exclusion list before staging the final payload as two archives, `node.zip` (a packaged Node.js/V8 runtime) and `build.zip` (the Brotli-compressed `app.jsc` bytecode payload, its `preflight.js` decompression loader, hidden-console helpers `winpty-agent.exe`/`winpty.dll`, and native `.node` PE-format modules).
The `app.jsc` payload itself is protected with four stacked obfuscation layers applied by the `javascript-obfuscator` library: identifier renaming, RC4-encrypted/Base64-encoded string protection reconstructed by decoder functions (averaging roughly 130,000 encrypted string chunks per sample), control-flow flattening into opaque state machines, and proxy/operation indirection that routes function calls and operators through helper wrappers. Check Point's new research describes a fully static deobfuscation pipeline (released as the public `jsc_deobfuscator` tool, built on the View8 V8-bytecode decompiler) that reverses all four layers without dynamic execution: Brotli decompression, bytecode disassembly, value propagation, RC4 string recovery, control-flow unflattening, proxy resolution, operation inlining, and an optional LLM-assisted function-renaming pass (Claude Sonnet 4.6 produced materially more useful labels than GPT-5.4-mini in Check Point's comparison). The pipeline was validated against a fully deobfuscated sample (MD5 e27ae65977287bdfb7b0e15fd3603f85).
Once running, JSCeal's capability set spans browser data theft (extracting the SQLite Cookies and Login Data databases and decrypting secrets protected by both legacy DPAPI and the newer Chromium App-Bound Encryption v10/v11/v20 key formats), active session compromise (using Puppeteer with stealth plugins and ghost-cursor mouse-movement emulation to replay stolen cookies into an automated browser, walk the Google OAuth flow, and mint fresh tokens scoped for `ANDROID` clients), a surveillance module (keylogging, screenshot capture, and window enumeration), and an HTTPS interception capability that generates a self-signed RSA-2048 root certificate, installs it via `certutil -addstore root`, and runs a local MITM proxy on 127.0.0.1 that performs service-specific request/response tampering against Binance, Bybit, and Ledger traffic (including QR-code override). Command and control runs a tRPC router over HTTPS POST and WSS to an `/rpc` endpoint parameterized with `machineId`/`token` values, exchanging binary `application/octet-stream` payloads.
The campaign's scale is significant: Check Point's July 2025 report documented roughly 35,000 malicious Facebook ads served across the EU in H1 2025 alone (an estimated 3.5 million EU impressions, with potential global exposure exceeding 10 million users), and WithSecure independently corroborated overlapping infrastruct
Target sectors: finance, cryptocurrency, consumer
Target regions: Europe, Global
Timeline
- JSCeal (later cross-tracked by other vendors as WEEVILPROXY / MeadowLocust) is first observed distributing compiled V8 bytecode (.jsc) payloads via a bundled Node.js runtime against cryptocurrency-focused victims.
- Check Point Research begins continuous tracking of the JSCeal cluster after identifying a recurring malvertising-to-Node.js delivery pattern.
- Microsoft documents related malvertising activity delivering the same Node.js/V8-bytecode payload chain, per subsequent secondary reporting.
- Check Point discloses that JSCeal-linked malvertising served roughly 35,000 malicious Facebook advertisements across the EU during January-June 2025, generating an estimated 3.5 million EU impressions and a potential global reach exceeding 10 million users.
- Check Point Research publishes 'Sealed Chain of Deception,' the first detailed public technical report on JSCEAL, documenting the malvertising-to-MSI-to-Node.js delivery chain, the local adversary-in-the-middle proxy, and impersonation of nearly 50 cryptocurrency trading platforms.
- WithSecure independently publishes analysis of overlapping activity under the name 'WeevilProxy,' confirming multi-vendor visibility into the same malware cluster.
- KPMG's Cyber Threat Intelligence Platform circulates a summarized JSCEAL threat brief to enterprise customers, reflecting continued analyst interest in the campaign.
- Check Point Research publishes 'Breaking the Seal,' detailing a static deobfuscation methodology for JSCeal's compiled V8 bytecode via the public jsc_deobfuscator toolkit, including a fully deobfuscated reference sample (MD5 e27ae65977287bdfb7b0e15fd3603f85), and presents the research at Black Hat USA 2026.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583.001, T1583.008, T1204.002, T1129, T1053.005, T1027, T1140, T1553.004, T1685, T1036.005
