Threats Tagged 'jsceal'

JSCeal is a sophisticated cryptocurrency-focused stealer malware delivered as compiled V8 bytecode executed by a bundled Node.js runtime. It uses multiple layers of JavaScript obfuscation and compilation to evade analysis. The malware includes capabilities such as keylogging, browser and credential theft, screenshot capture, and HTTPS traffic interception via a local man-in-the-middle proxy. Check Point Research developed a static deobfuscation pipeline to analyze JSCeal without execution, enabling detailed understanding of its behavior and evolution. The malware targets multiple platforms including macOS and continues to evolve with new payload encryption and targeting techniques.

A sophisticated malware campaign called JSCEAL is targeting cryptocurrency users through fake apps impersonating popular trading platforms. The attackers use malicious ads to lure victims into downloading installers that deploy a multi-stage infection chain. This includes PowerShell scripts for profiling and a final payload of compiled JavaScript (JSC) files executed via Node.js. The JSCEAL malware steals crypto-related data and credentials while employing advanced evasion techniques. The campaign has potentially reached millions of users across multiple countries, primarily targeting the cryptocurrency and financial sectors.

MediumMalwareGermanyUnited KingdomFrance+4#fake apps#stealer#cryptocurrency