Crypto-Stealer JSCeal Conceals Malware in V8 Bytecode to Harvest Browser Logins and Hijack HTTPS Traffic

Security researchers have identified a new cryptocurrency‑focused information stealer, dubbed JSCeal, that disguises its malicious code within compiled V8 JavaScript bytecode. By delivering the payload as non‑human‑readable bytecode rather than plain text JavaScript, the attackers aim to bypass traditional script‑analysis tools and evade detection on compromised systems.

The malware, also referenced by some security vendors as WEEVILPROXY or MeadowLocust, infiltrates browsers and proceeds to capture stored credentials, session cookies, and other sensitive data. In addition to credential theft, JSCeal is capable of intercepting HTTPS traffic, allowing it to read or modify encrypted communications once the attacker has subverted the browser's security context.

Analysts note that the use of V8 bytecode is a notable escalation in the threat landscape. V8, the JavaScript engine behind Chrome and many other browsers, compiles scripts into an intermediate bytecode format before execution. By embedding malicious logic at this stage, JSCeal sidesteps static analysis that relies on pattern matching of readable JavaScript, forcing defenders to resort to more resource‑intensive dynamic analysis or specialized bytecode de‑obfuscation techniques.

The campaign appears to target users involved in cryptocurrency trading, mining, or related services, where the payoff for stolen credentials can be substantial. Operators typically distribute the payload through phishing emails, malicious ads, or compromised websites that lure victims into downloading what appears to be a legitimate update or utility. Once executed, the bytecode runs within the victim's browser context, silently exfiltrating data to command‑and‑control servers controlled by the threat actors.

Cyber‑security firms are urging organizations and individual users to update browsers and extensions promptly, employ reputable endpoint protection that can inspect runtime behavior, and consider deploying network‑level TLS inspection where privacy policies allow. As researchers continue to dissect JSCeal's architecture, further indicators of compromise are expected to emerge, helping defenders to craft signatures and heuristics that can detect the bytecode payload despite its obfuscated form.