JSCeal Malware Replays Stolen Google Browser Sessions

JSCeal targets browser sessions and cryptocurrency users

Check Point Research has analysed JSCeal, a compiled V8 JavaScript malware that steals browser data and can reconstruct a victim’s browser session using stolen cookies. The capability enables active session replay attacks intended to bypass authentication and obtain unauthorised access to Google accounts.

JSCeal was first documented by Check Point in July 2025. The activity has been linked by overlap to threat clusters tracked as WEEVILPROXY and MeadowLocust. Its operators have used malicious advertisements on Facebook and Google to redirect prospective victims to counterfeit cryptocurrency-trading sites.

Those sites present bogus TradingView installers. The malvertising delivery chain uses two ZIP archives launched through PowerShell: one contains the Node.js runtime, while the other contains the main payload and auxiliary components.

Cookie theft extends beyond password collection

The malware enumerates installed browsers and searches their user-data directories for available profiles. It extracts saved secrets, cookies, OAuth tokens and other browser information, then passes the collected material through router functions that register handlers for it.

The browser-stealing component covers a broad set of Chromium-based products, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Avast Secure Browser, Vivaldi and Cốc Cốc. For each discovered browser, JSCeal lists profiles and retrieves cookies and passwords from the expected local locations.

Session cookies are particularly important because they can be used to restore an authenticated browser state. In JSCeal’s case, the recovered code supports session reconstruction and replay against Google accounts, turning browser data theft into a means of bypassing a login step rather than merely collecting credentials.

Obfuscation and traffic manipulation complicate response

Check Point Research said the payload is protected with javascript-obfuscator. The operators rename functions and variables, split and RC4-protect strings, flatten control flow into switch-driven loops, and route calls or simple operations through proxy helpers. Check Point developed a fully static deobfuscation pipeline for the compiled V8 bytecode to recover the execution flow and functions.

A separate module records keystrokes and takes screenshots. Recovered code also shows setup of a local proxy, certificate generation and installation, plus service-specific request and response changes. Dedicated overrides exist for Binance, Bybit and Ledger, alongside generic functions for HTML replacement, host blocking and clearing selected cookies. Some handlers capture account information and cryptocurrency balances.

Confiant has also described SourTrade, a malvertising operation active since late 2024 that impersonates trading and cryptocurrency brands including Solana, Luno and TradingView. It sends browser-side instructions that assemble malware in memory from a legitimate file fetched separately, and the campaign overlaps with JSCeal activity described by Bitdefender in September 2025.

Business implication

Businesses should treat browser sessions as sensitive authentication assets: limiting unapproved software installation, investigating suspicious advertising redirects, and monitoring endpoints for unexpected PowerShell, proxy or certificate activity can help reduce exposure to this delivery and session-replay chain.