Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated malware campaign called JSCEAL is targeting cryptocurrency users through fake apps impersonating popular trading platforms. The attackers use malicious ads to lure victims into downloading installers that deploy a multi-stage infection chain. This includes PowerShell scripts for profiling and a final payload of compiled JavaScript (JSC) files executed via Node.js. The JSCEAL malware steals crypto-related data and credentials while employing advanced evasion techniques. The campaign has potentially reached millions of users across multiple countries, primarily targeting the cryptocurrency and financial sectors.

The JSCEAL malware campaign represents a sophisticated multi-stage attack targeting cryptocurrency users by leveraging fake applications that impersonate legitimate and popular cryptocurrency trading platforms. The attackers employ malvertising techniques to distribute malicious installers, which initiate a complex infection chain. This chain begins with PowerShell scripts used for system profiling and reconnaissance, gathering detailed information about the victim's environment. The final payload consists of compiled JavaScript files executed via Node.js, a runtime environment that allows JavaScript to run outside a browser. This approach enables the malware to perform stealthy operations and evade traditional detection mechanisms. JSCEAL is designed to steal sensitive cryptocurrency-related data, including wallet credentials and private keys, thereby compromising the confidentiality and integrity of users' digital assets. The malware also incorporates advanced evasion techniques such as obfuscation, anti-debugging, and persistence mechanisms to maintain long-term access and avoid detection. Although no known exploits are currently reported in the wild, the campaign has potentially affected millions of users worldwide, primarily focusing on the cryptocurrency and financial sectors. The use of Node.js for executing malicious JavaScript payloads is notable, as it allows attackers to blend in with legitimate development environments and complicates detection efforts. The campaign's reliance on fake apps and malvertising highlights the importance of user vigilance and robust application vetting processes.

Detailed information about Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal. Get real-time updates, technical details, and mitigation strat

Title	Severity	Type	Source	Date

Threats Tagged 'fake apps'

Filter Threats

Threats Tagged 'fake apps'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility