Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal

A sophisticated malware campaign called JSCEAL is targeting cryptocurrency users through fake apps impersonating popular trading platforms. The attackers use malicious ads to lure victims into downloading installers that deploy a multi-stage infection chain. This includes PowerShell scripts for profiling and a final payload of compiled JavaScript (JSC) files executed via Node.js. The JSCEAL malware steals crypto-related data and credentials while employing advanced evasion techniques. The campaign has potentially reached millions of users across multiple countries, primarily targeting the cryptocurrency and financial sectors.

• Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 BytecodeMalware2026-08-31
• QuartzLine: A working PDF viewer with a backdoor insideMalware2026-10-16
• Variola: From ClickFix to a Modular ImplantMalware2026-10-16
• Kimsuky attacks targeting Ukrainian experts in diplomacy, security, and international policyCampaign2026-10-13
• 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet CredentialsCampaign2026-10-08