# JSCeal (WEEVILPROXY / MeadowLocust) infostealer: malvertising-delivered Node.js malware with obfuscated V8 bytecode

> JSCeal, also tracked as WEEVILPROXY and MeadowLocust, is a financially motivated infostealer active since March 2024. It is delivered through malvertising and fake crypto-trading installers, then runs as Brotli-compressed V8 bytecode (app.jsc) under a bundled Node.js runtime. It steals browser credentials, cookies and Telegram sessions, captures screenshots and keystrokes, targets crypto wallets, and runs a local HTTPS proxy to tamper with Binance, Bybit and Ledger traffic.

- **Published:** 2026-10-22T17:06:48Z
- **Last reviewed:** 2026-10-22T17:06:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4165
- **ID:** TL-2026-4165
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

JSCeal (reported by WithSecure and Microsoft-era reporting as WEEVILPROXY, and tracked as MeadowLocust) is a modular, multi-stage infostealer and remote-access framework aimed at retail traders and cryptocurrency users. Check Point Research reported that during H1 2025 the operators promoted around 35,000 malicious advertisements (largely on Facebook, also Google) impersonating nearly 50 crypto and trading brands such as Binance, Bybit, OKX, Ledger, Phantom, MetaMask and TradingView. Victims were redirected to fake sites (domains of the form [word]-[word].com built from app/download/desktop/pc/window) that serve MSI installers. Check Point's July 2025 report puts the campaign at 12 countries and 25 languages, concentrated in Asia Pacific and Latin America.

Stage 1 is an MSI installer signed with valid Authenticode certificates issued to Russian-registered companies. It contains CustomActions.dll (which opens an HTTP listener on http://localhost:30303 that the malicious website talks to, so neither the site nor the installer works alone), TaskScheduler.dll and WMI.dll. A scheduled task (WindowsSoftwareHealthCheckerTask) runs as SYSTEM and executes encoded PowerShell. The PowerShell adds Microsoft Defender exclusions for the PowerShell process and the working directory (Add-MpPreference), fingerprints the host (MachineGuid, installed software, UAC and proxy settings, email data) and reports it to C2 as JSON. Operators use this profile to decide which victims to continue with.

Stage 2 downloads node.zip (the Node.js runtime) and build.zip from Cloudflare Pages domains (pages.dev). build.zip holds app.jsc (the Brotli-compressed, javascript-obfuscated V8 bytecode payload), preflight.js (decompression loader), winpty-agent.exe and winpty.dll (open-source console agent), and native .node modules. Execution is: .\node.exe -r .\preflight.js .\app.jsc. The payload is V8 version-specific (10.2.154.26-node.25 in the samples analysed by Check Point). It is obfuscated with javascript-obfuscator (RC4-protected strings, control-flow flattening, proxy functions, operation wrappers). Hundreds of samples were reported undetected on VirusTotal.

Capabilities: theft of cookies (<profile>\Network\Cookies), Login Data, OAuth tokens, extensions and bookmarks from Chrome, Edge, Brave, Opera, Opera GX, Avast, Vivaldi and Coc Coc, including DPAPI-based key recovery; Puppeteer (stealth plugin, ghost-cursor) session replay that injects stolen cookies, hits Google's android auth endpoint and tries to mint fresh OAuth tokens with ANDROID scope; Telegram session enumeration; screenshots, keylogging, window enumeration and installed-application enumeration; PowerShell command execution (RAT behaviour); crypto-wallet and exchange data collection (Phantom vault, Binance balances and similar); and a local man-in-the-middle HTTPS proxy on 127.0.0.1 with a self-signed RSA-2048 certificate installed via certutil -addstore root, with service-specific overrides for Binance, Bybit and Ledger (HTML replacement, host blocking, cookie clearing). It overrides DNS to 1.1.1.1 and 8.8.8.8. C2 uses a tRPC WebSocket (wss://api.<domain>/rpc) or HTTP POST to /rpc (application/octet-stream) with machineId and token parameters, with DNS-over-HTTPS resolution via Cloudflare. Endpoints seen include /wallets/mnemonic/save and /applications/secrets/save. A cleanup script removes %SystemDrive%\Recovery\OEM, unregisters the scheduled task and kills node.

The malware keeps evolving. Check Point reports November 2025 campaigns adding AES-256-CBC encryption, a newer Node.js/V8 runtime (13.6.233.10) and macOS targeting. Check Point's 31 August 2026 article (presented at Black Hat USA 2026) documents static deobfuscation of the V8 bytecode via View8 pseudocode and released the jsc_deobfuscator toolkit (string deobfuscation, control-flow unflattening, optional LLM-assisted renaming). Attribution to a named actor or nation is not established in the sources.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1553.004 Install Root Certificate
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1550.004 Web Session Cookie
- T1056.001 Keylogging
- T1113 Screen Capture
- T1185 Browser Session Hijacking
- T1082 System Information Discovery
- T1071.001 Web Protocols

## Sources

- [Breaking the Seal: Static Deobfuscation of JSCeal's Compiled V8 Bytecode](https://research.checkpoint.com/2026/breaking-the-seal-static-deobfuscation-of-jsceals-compiled-v8-bytecode/)
- [JSCEAL Targets Crypto Apps](https://research.checkpoint.com/2025/jsceal-targets-crypto-apps/)
- [Threat actors misuse Node.js to deliver malware and other malicious payloads](https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/)
- [jsc_deobfuscator (Check Point static deobfuscation toolkit)](https://github.com/hasherezade/jsc_deobfuscator)
- [The Hacker News: JSCeal malware can bypass Google authentication](https://thehackernews.com/2026/09/jsceal-malware-can-bypass-google.html)
- [The Hacker News: Hackers use Facebook ads to spread JSCEAL (fake cryptocurrency trading apps)](https://thehackernews.com/2025/07/hackers-use-facebook-ads-to-spread.html)
- [The Hacker News: Node.js malware campaign targets crypto users with fake Binance and TradingView installers](https://thehackernews.com/2025/04/nodejs-malware-campaign-targets-crypto.html)
- [Cointelegraph: Crypto users warned as ads push malware-laden crypto apps](https://cointelegraph.com/news/crypto-users-warned-as-ads-push-malware-laden-crypto-apps)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4165