Threat reportMalwareTL-2026-4165
JSCeal (WEEVILPROXY / MeadowLocust) infostealer: malvertising-delivered Node.js malware with obfuscated V8 bytecode
JSCeal (WEEVILPROXY / MeadowLocust) infostealer (TL-2026-4165), also tracked as JSCEAL, is a high-severity malware campaign, first published 2026-10-22. It has no confirmed attribution, affects Microsoft Windows (endpoints of cryptocurrency and trading-platform, maps to 17 MITRE ATT&CK techniques (T1027, T1047, T1053.005), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-4165
- Threat ID
- TL-2026-4165
- Also known as
- JSCEAL, WEEVILPROXY, MeadowLocust
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, cryptocurrency, retail traders, individual users
- Target regions
- Asia Pacific, Latin America, Europe
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in JSCeal (WEEVILPROXY / MeadowLocust) infostealer
Malware and tooling: WEEVILPROXY, certutil - S0160
How JSCeal (WEEVILPROXY / MeadowLocust) infostealer works
JSCeal, also tracked as WEEVILPROXY and MeadowLocust, is a financially motivated infostealer active since March 2024. It is delivered through malvertising and fake crypto-trading installers, then runs as Brotli-compressed V8 bytecode (app.jsc) under a bundled Node.js runtime. It steals browser credentials, cookies and Telegram sessions, captures screenshots and keystrokes, targets crypto wallets, and runs a local HTTPS proxy to tamper with Binance, Bybit and Ledger traffic.
JSCeal (reported by WithSecure and Microsoft-era reporting as WEEVILPROXY, and tracked as MeadowLocust) is a modular, multi-stage infostealer and remote-access framework aimed at retail traders and cryptocurrency users. Check Point Research reported that during H1 2025 the operators promoted around 35,000 malicious advertisements (largely on Facebook, also Google) impersonating nearly 50 crypto and trading brands such as Binance, Bybit, OKX, Ledger, Phantom, MetaMask and TradingView. Victims were redirected to fake sites (domains of the form [word]-[word].com built from app/download/desktop/pc/window) that serve MSI installers. Check Point's July 2025 report puts the campaign at 12 countries and 25 languages, concentrated in Asia Pacific and Latin America.
Stage 1 is an MSI installer signed with valid Authenticode certificates issued to Russian-registered companies. It contains CustomActions.dll (which opens an HTTP listener on http://localhost:30303 that the malicious website talks to, so neither the site nor the installer works alone), TaskScheduler.dll and WMI.dll. A scheduled task (WindowsSoftwareHealthCheckerTask) runs as SYSTEM and executes encoded PowerShell. The PowerShell adds Microsoft Defender exclusions for the PowerShell process and the working directory (Add-MpPreference), fingerprints the host (MachineGuid, installed software, UAC and proxy settings, email data) and reports it to C2 as JSON. Operators use this profile to decide which victims to continue with.
Stage 2 downloads node.zip (the Node.js runtime) and build.zip from Cloudflare Pages domains (pages.dev). build.zip holds app.jsc (the Brotli-compressed, javascript-obfuscated V8 bytecode payload), preflight.js (decompression loader), winpty-agent.exe and winpty.dll (open-source console agent), and native .node modules. Execution is: .\node.exe -r .\preflight.js .\app.jsc. The payload is V8 version-specific (10.2.154.26-node.25 in the samples analysed by Check Point). It is obfuscated with javascript-obfuscator (RC4-protected strings, control-flow flattening, proxy functions, operation wrappers). Hundreds of samples were reported undetected on VirusTotal.
Capabilities: theft of cookies (<profile>\Network\Cookies), Login Data, OAuth tokens, extensions and bookmarks from Chrome, Edge, Brave, Opera, Opera GX, Avast, Vivaldi and Coc Coc, including DPAPI-based key recovery; Puppeteer (stealth plugin, ghost-cursor) session replay that injects stolen cookies, hits Google's android auth endpoint and tries to mint fresh OAuth tokens with ANDROID scope; Telegram session enumeration; screenshots, keylogging, window enumeration and installed-application enumeration; PowerShell command execution (RAT behaviour); crypto-wallet and exchange data collection (Phantom vault, Binance balances and similar); and a local man-in-the-middle HTTPS proxy on 127.0.0.1 with a self-signed RSA-2048 certificate installed via certutil -addstore root, with service-specific overrides for Binance, Bybit and Ledger (HTML replacement, host blocking, cookie clearing). It overrides DNS to 1.1.1.1 and 8.8.8.8. C2 uses a tRPC WebSocket (wss://api.<domain>/rpc) or HTTP POST to /rpc (application/octet-stream) with machineId and token parameters, with DNS-over-HTTPS resolution via Cloudflare. Endpoints seen include /wallets/mnemonic/save and /applications/secrets/save. A cleanup script removes %SystemDrive%\Recovery\OEM, unregisters the scheduled task and kills node.
The malware keeps evolving. Check Point reports November 2025 campaigns adding AES-256-CBC encryption, a newer Node.js/V8 runtime (13.6.233.10) and macOS targeting. Check Point's 31 August 2026 article (presented at Black Hat USA 2026) documents static deobfuscation of the V8 bytecode via View8 pseudocode and released the jsc_deobfuscator toolkit (string deobfuscation, control-flow unflattening, optional LLM-assisted renaming). Attribution to a named actor or nation is not established in the sources.
MITRE ATT&CK techniques used in TL-2026-4165
Defense Evasion
T1027 Obfuscated Files or Information
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File
Persistence
Collection
T1056.001 Keylogging; T1113 Screen Capture; T1185 Browser Session Hijacking
Command and Control
Discovery
T1082 System Information Discovery
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
lateral-movement
defense-impairment
T1553.004 Install Root Certificate; T1685 Disable or Modify Tools
Resource Development
Affected products and versions in JSCeal (WEEVILPROXY / MeadowLocust) infostealer
Remediation for JSCeal (WEEVILPROXY / MeadowLocust) infostealer
Immediate actions
- Hunt for node.exe launched with '-r .\preflight.js' against an .jsc file, and for node.exe running from user-writable paths on hosts with no Node.js install
- Hunt for the scheduled task WindowsSoftwareHealthCheckerTask and for Add-MpPreference exclusions added by PowerShell
- Block the C2, redirection and Cloudflare Pages/Workers/tunnel hostnames listed in the IOCs at DNS and proxy
- Look for rogue root certificates added with certutil -addstore root and for a local listener on TCP 30303
- On confirmed infection, isolate the host, revoke browser sessions and OAuth tokens, rotate passwords, and move crypto assets and wallet seeds to new wallets
Workarounds
- Block newly registered [word]-[word].com download lookalike domains at the proxy
- Restrict access to pages.dev, workers.dev and trycloudflare.com for managed endpoints where business needs allow
- Enforce hardware-backed wallets with on-device transaction verification
Longer-term hardening
- Enable script block logging and AMSI; alert on obfuscated PowerShell
- Enable EDR in block mode and cloud-delivered protection; use attack surface reduction rules against obfuscated scripts
- Restrict MSI installs from the internet and enforce application control for unsanctioned node.exe
- Train users that exchange and trading apps must come only from official vendor sites, not ads
- Monitor for new root certificates in the machine and user trust stores
Timeline of JSCeal (WEEVILPROXY / MeadowLocust) infostealer
- JSCeal/WEEVILPROXY campaign activity begins (March 2024, per Check Point and WithSecure reporting; exact day not stated)
- Microsoft Defender Experts begin observing Node.js-based malvertising campaigns delivering info-stealing payloads (October 2024; exact day not stated)
- Microsoft publishes 'Threat actors misuse Node.js to deliver malware', documenting fake Binance/TradingView installers, CustomActions.dll scheduled-task persistence, and trycloudflare.com C2
- Check Point Research publishes 'JSCEAL Targets Crypto Apps': ~35,000 malicious ads in H1 2025 impersonating almost 50 crypto brands, MSI/PowerShell/JSC infection flow and C2 domains
- November 2025 campaigns introduce AES-256-CBC encryption, upgraded Node.js/V8 runtime (13.6.233.10) and macOS targeting (per Check Point; exact day not stated)
- Check Point publishes 'Breaking the Seal' static V8 bytecode deobfuscation research and releases jsc_deobfuscator; presented at Black Hat USA 2026
Sources cited for JSCeal (WEEVILPROXY / MeadowLocust) infostealer
- Breaking the Seal: Static Deobfuscation of JSCeal's Compiled V8 Bytecode
- JSCEAL Targets Crypto Apps
- Threat actors misuse Node.js to deliver malware and other malicious payloads
- jsc_deobfuscator (Check Point static deobfuscation toolkit)
- The Hacker News: JSCeal malware can bypass Google authentication
- The Hacker News: Hackers use Facebook ads to spread JSCEAL (fake cryptocurrency trading apps)
- The Hacker News: Node.js malware campaign targets crypto users with fake Binance and TradingView installers
- Cointelegraph: Crypto users warned as ads push malware-laden crypto apps
Detection coverage for TL-2026-4165
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4165 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.