JSCeal Malware Bypasses Google Auth Using Compiled V8 Bytecode

Check Point Research has uncovered JSCeal, a sophisticated cryptocurrency-focused stealer that bypasses Google authentication to hijack user accounts. The malware is distributed through malicious advertisements that lure victims into installing fake cryptocurrency applications.

To evade security analysis, JSCeal is delivered as compiled V8 bytecode in the form of JSC files. This approach makes the malware significantly harder to analyze than standard JavaScript. According to Check Point Research, the payloads are further protected using javascript-obfuscator, which employs control-flow flattening, proxy functions, and RC4-protected strings to hide the code's intent.

The Token Minting Technique

The malware's primary innovation is its ability to circumvent Google's authentication protections. Rather than simply stealing session cookies and attempting to use them from a remote server—which often triggers security alerts due to IP or device mismatches—JSCeal operates within the victim's own browser context.

By replaying stolen session cookies locally, the malware can mint fresh OAuth tokens directly inside the browser. This technique allows the attacker to maintain access to the account while appearing to the system as the legitimate user on a trusted device.

Industry Context

Check Point Research has been tracking this campaign since early 2025. The attackers specifically target the cryptocurrency community, leveraging the high value of digital assets and the trust users place in established crypto platforms. By mimicking these platforms through malicious ads, the campaign successfully tricks users into deploying the stealer on their own systems.

Why It Matters

JSCeal represents a significant escalation in the sophistication of credential stealers. The use of compiled bytecode allows the malware to slip past many traditional signature-based detection tools that look for plain-text JavaScript patterns.

Furthermore, the "token minting" method renders traditional session protections less effective. Because the authentication happens within the victim's active browser session, the security measures designed to flag suspicious logins from foreign locations are effectively neutralized, granting attackers a stealthier path to sensitive financial data.

What's Next

Security researchers continue to monitor the evolution of the JSCeal campaign as it adapts its obfuscation methods. While the core mechanism of V8 bytecode delivery has been exposed, the prevalence of the campaign across various fake cryptocurrency apps suggests a wide-reaching infrastructure. Users are advised to remain vigilant against third-party crypto application ads and to employ hardware-based multi-factor authentication to mitigate the risk of session hijacking.