# JSCeal Cryptocurrency Stealer: Check Point Details Static Deobfuscation of Compiled V8 Bytecode Payloads

> Check Point Research's "Breaking the Seal" details a static deobfuscation methodology for JSCeal (also tracked as WEEVILPROXY / MeadowLocust), a cryptocurrency-focused stealer active since March 2024 that ships as compiled V8 bytecode (.jsc) inside a bundled Node.js runtime. The malware performs keylogging, browser/credential theft, active session hijacking, and HTTPS interception via a locally installed MITM proxy and root certificate, targeting Chromium browsers, Telegram, and cryptocurrency platforms (Binance, Bybit, Ledger, Phantom) on Windows and macOS.

- **Published:** 2026-08-31T00:00:00Z
- **Last reviewed:** 2026-08-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2259
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-jsceal-node-js-crypto-stealer-tl-2026-2259.webp?v=d9c0d935 (Threadlinqs threat intel: JSCeal V8 Bytecode Stealer: Detection & IOCs (TL-2026-2259) — High severity, 22 IOCs, 9 detection rules.)
- **ID:** TL-2026-2259
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)

## Description

JSCeal is a cryptocurrency-focused information stealer and adversary-in-the-middle toolkit, cross-tracked by other vendors as WEEVILPROXY (WithSecure) and MeadowLocust, that has been active since March 2024 and continuously tracked by Check Point Research since early 2025. Its distinguishing trait is delivery as compiled V8 bytecode (.jsc files) rather than plaintext JavaScript, executed through a bundled Node.js runtime (`node.exe -r preflight.js app.jsc`) rather than a conventional native binary, which historically let hundreds of samples evade signature-based detection on VirusTotal.

The documented delivery chain begins with malvertising (large-scale Facebook ad campaigns using stolen/newly-created accounts) that redirects victims through geolocation- and referrer-filtered landing pages impersonating nearly 50 cryptocurrency exchanges and trading platforms, including TradingView, Binance, and OKX. Victims who pass the filtering are served an MSI installer historically signed with valid certificates belonging to Russian entities; the installer drops DLLs that establish a local HTTP listener, register a scheduled task under SYSTEM privileges for persistence, and add the malware's paths to Windows Defender's exclusion list before staging the final payload as two archives, `node.zip` (a packaged Node.js/V8 runtime) and `build.zip` (the Brotli-compressed `app.jsc` bytecode payload, its `preflight.js` decompression loader, hidden-console helpers `winpty-agent.exe`/`winpty.dll`, and native `.node` PE-format modules).

The `app.jsc` payload itself is protected with four stacked obfuscation layers applied by the `javascript-obfuscator` library: identifier renaming, RC4-encrypted/Base64-encoded string protection reconstructed by decoder functions (averaging roughly 130,000 encrypted string chunks per sample), control-flow flattening into opaque state machines, and proxy/operation indirection that routes function calls and operators through helper wrappers. Check Point's new research describes a fully static deobfuscation pipeline (released as the public `jsc_deobfuscator` tool, built on the View8 V8-bytecode decompiler) that reverses all four layers without dynamic execution: Brotli decompression, bytecode disassembly, value propagation, RC4 string recovery, control-flow unflattening, proxy resolution, operation inlining, and an optional LLM-assisted function-renaming pass (Claude Sonnet 4.6 produced materially more useful labels than GPT-5.4-mini in Check Point's comparison). The pipeline was validated against a fully deobfuscated sample (MD5 e27ae65977287bdfb7b0e15fd3603f85).

Once running, JSCeal's capability set spans browser data theft (extracting the SQLite Cookies and Login Data databases and decrypting secrets protected by both legacy DPAPI and the newer Chromium App-Bound Encryption v10/v11/v20 key formats), active session compromise (using Puppeteer with stealth plugins and ghost-cursor mouse-movement emulation to replay stolen cookies into an automated browser, walk the Google OAuth flow, and mint fresh tokens scoped for `ANDROID` clients), a surveillance module (keylogging, screenshot capture, and window enumeration), and an HTTPS interception capability that generates a self-signed RSA-2048 root certificate, installs it via `certutil -addstore root`, and runs a local MITM proxy on 127.0.0.1 that performs service-specific request/response tampering against Binance, Bybit, and Ledger traffic (including QR-code override). Command and control runs a tRPC router over HTTPS POST and WSS to an `/rpc` endpoint parameterized with `machineId`/`token` values, exchanging binary `application/octet-stream` payloads.

The campaign's scale is significant: Check Point's July 2025 report documented roughly 35,000 malicious Facebook ads served across the EU in H1 2025 alone (an estimated 3.5 million EU impressions, with potential global exposure exceeding 10 million users), and WithSecure independently corroborated overlapping infrastructure under the name WeevilProxy, indicating multi-vendor visibility into the same cluster. No CVE or vendor patch applies, since the threat is entirely social-engineering- and behavior-driven rather than vulnerability-driven; defense depends on detecting the Node.js-bytecode execution pattern, root-certificate installation, and anomalous local-proxy/scheduled-task artifacts described above.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.008 Malvertising
- T1204.002 Malicious File
- T1129 Shared Modules
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1553.004 Install Root Certificate
- T1685 Disable or Modify Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1497 Virtualization/Sandbox Evasion
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1557 Adversary-in-the-Middle
- T1010 Application Window Discovery
- T1082 System Information Discovery
- T1113 Screen Capture
- T1056.001 Keylogging
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**JSCeal Node.js V8 Bytecode Payload Execution (node.exe -r preflight.js app.jsc)** (`TL-2026-2259-SPL-001`)

Detects the bundled Node.js runtime being invoked with the '-r preflight.js' loader flag against the Brotli-compressed compiled V8 bytecode payload 'app.jsc' — JSCeal's distinguishing execution pattern that historically evaded signature-based AV because the payload never ships as plaintext JavaScript or a native PE. Fires on the initial-access/execution stage after the MSI installer stages node.zip/build.zip.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1129, T1027
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
`comment("Detects node.exe executing preflight.js loader against compiled V8 bytecode payload app.jsc - JSCeal/WEEVILPROXY/MeadowLocust delivery pattern")`
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(lower(Image), "\\\\node\.exe$") OR match(lower(OriginalFileName), "node\.exe")
| where match(lower(CommandLine), "preflight\.js") AND match(lower(CommandLine), "app\.jsc")
| eval mitre_technique="T1204.002,T1129,T1027"
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName, User, Image, ParentImage, CommandLine
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table ComputerName, User, Image, ParentImage, CommandLine, count, first_seen, last_seen, mitre_technique
| sort -last_seen
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "node.exe"
| where ProcessCommandLine has "preflight.js" and ProcessCommandLine has "app.jsc"
| extend MitreTechniques = "T1204.002,T1129,T1497"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, MitreTechniques
| order by Timestamp desc
```

### Sigma

```yaml
title: Node.js Runtime Executing Compiled V8 Bytecode Payload (JSCeal Pattern)
id: 7c2f9a1e-4b3d-4e6a-9f0d-1a2b3c4d5e6f
status: experimental
description: Detects node.exe invoked with the preflight.js loader against a compiled V8 bytecode file named app.jsc, the JSCeal/WEEVILPROXY/MeadowLocust cryptocurrency-stealer execution pattern documented by Check Point Research.
references:
  - https://research.checkpoint.com/2026/breaking-the-seal-static-deobfuscation-of-jsceals-compiled-v8-bytecode/
  - https://research.checkpoint.com/2025/jsceal-targets-crypto-apps/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-31
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1129
  - attack.defense_evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\node.exe'
  selection_cli:
    CommandLine|contains|all:
      - 'preflight.js'
      - 'app.jsc'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate Node.js developers running a script literally named preflight.js against a file literally named app.jsc (rare naming collision in sanctioned dev/build environments)
level: high
```

**Known false positives:**

- Sanctioned developer or CI/build environments that legitimately name a loader script 'preflight.js' and a bytecode artifact 'app.jsc' — scope by excluding known build-server hostnames/paths

**Tuning notes:** Exclude sanctioned CI/build hosts by ComputerName/DeviceName allowlist; widen matching to '-r preflight.js' as a distinct token pair rather than substring if false positives appear from unrelated Node tooling.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- JSCeal Compiled Bytecode Loader Execution via Node.js Runtime (locked: unlock with TL Creds)
- JSCeal SYSTEM-Level Scheduled Task and Root Certificate Persistence (locked: unlock with TL Creds)
- Non-Browser Process Access to Chromium Login Data/Cookies Databases (JSCeal Credential Theft) (locked: unlock with TL Creds)
- Node.js Runtime Executing Compiled V8 Bytecode Payload (JSCeal Pattern) (locked: unlock with TL Creds)
- JSCeal Persistence via SYSTEM Scheduled Task and Windows Defender Exclusion (locked: unlock with TL Creds)
- JSCeal Local MITM Proxy Listener and /rpc C2 Network Beacon (locked: unlock with TL Creds)
- JSCeal Persistence and Defense-Evasion Chain (SYSTEM Scheduled Task + Root Cert + Defender Exclusion) (locked: unlock with TL Creds)
- JSCeal Local AitM Proxy and tRPC C2 Callback (incl. Malvertising Infrastructure) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- IP address: `1.1.1[.]1`
- File hash: `e27ae65977287bdfb7b0e15fd3603f85`
- IP address: `8.8.8[.]8`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Breaking the Seal: Static Deobfuscation of JSCeal's Compiled V8 Bytecode](https://research.checkpoint.com/2026/breaking-the-seal-static-deobfuscation-of-jsceals-compiled-v8-bytecode/)
- [jsc_deobfuscator (View8-based deobfuscation tooling)](https://github.com/hasherezade/jsc_deobfuscator)
- [Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCEAL](https://research.checkpoint.com/2025/jsceal-targets-crypto-apps/)
- [New JSCEAL Malware Targets Crypto App Users](https://blog.checkpoint.com/crypto/jsceal-targets-crypto-app-users-a-new-threat-in-the-cyber-security-landscape/)
- [Hackers Use Facebook Ads to Spread JSCEAL Malware via Fake Crypto Apps](https://thehackernews.com/2025/07/hackers-use-facebook-ads-to-spread.html)
- [New JSCEAL Attack Aims to Steal Credentials and Wallets from Crypto Users](https://gbhackers.com/new-jsceal-attack-aims-to-steal-credentials/)
- [Cato CTRL Threat Research: A Deep Dive into a New JSCEAL Infostealer Campaign](https://www.catonetworks.com/blog/cato-ctrl-deep-dive-into-new-jsceal-infostealer-campaign/)
- [Spyware.JSCeal Threat Detection](https://www.threatdown.com/threat-detections/spyware-jsceal/)
- [KPMG CTIP: JSCEAL Threat Intelligence Brief](https://assets.kpmg.com/content/dam/kpmgsites/in/pdf/2025/08/kpmg-ctip-jsceal-19-aug-2025.pdf.coredownload.inline.pdf)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2259