Threats Tagged 'deobfuscation'

JSCeal is a sophisticated cryptocurrency-focused stealer malware delivered as compiled V8 bytecode executed by a bundled Node.js runtime. It employs multiple layers of JavaScript obfuscation and encryption, including RC4 and AES-256-CBC, to protect its payload. The malware's capabilities include keylogging, browser credential theft, cryptocurrency collection, HTTPS traffic interception via a local man-in-the-middle proxy, and session replay using stolen cookies. Recent variants target macOS and newer V8 versions, showing active development. Check Point Research developed a fully static deobfuscation pipeline to analyze JSCeal without executing it, enabling detailed understanding of its behavior. The toolkit is publicly available and supports analysis of multiple samples.