Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode

JSCeal is a malware family delivering a cryptocurrency stealer as compiled V8 bytecode (.jsc) executed by a bundled Node.js runtime. It uses javascript-obfuscator with multiple protection layers such as RC4-encrypted strings, control-flow flattening, proxy functions, and operation wrappers. The payload is distributed compressed and obfuscated, complicating analysis. Check Point Research developed a static deobfuscation pipeline based on the View8 open-source V8 bytecode decompiler, extended with passes for value propagation, string reconstruction, control-flow unflattening, and proxy resolution. This pipeline recovers pseudocode enabling detailed static analysis of JSCeal’s capabilities including keylogging, credential theft, HTTPS interception through a local MITM proxy, and session replay. The malware has evolved to target macOS, newer V8 versions, and added AES-256-CBC encryption layers. The research and toolkit were presented at Black Hat USA 2026 and are publicly available.

JSCeal enables attackers to steal sensitive information including browser credentials and cryptocurrency wallet data, log keystrokes, intercept HTTPS traffic via a local man-in-the-middle proxy, and replay active sessions using stolen cookies. This can lead to unauthorized access to cryptocurrency accounts and other online services, resulting in financial theft and privacy breaches. The malware’s use of advanced obfuscation and encryption complicates detection and analysis, increasing the risk of successful infections and prolonged undetected activity. The targeting of macOS and newer V8 versions indicates expanding attack surface and active development.

No official patch or vendor advisory is provided for this malware. Mitigation focuses on detection and prevention through endpoint protection, network monitoring for suspicious local proxy activity, and blocking delivery vectors such as malvertising and PowerShell-based infection chains. The publicly available static deobfuscation toolkit can assist analysts in identifying and understanding JSCeal samples. Organizations should apply standard security best practices to limit exposure to malicious scripts and executables. Since this is malware rather than a software vulnerability, no direct patch exists.