Since early 2025, Check Point Research has been tracking JSCeal, a sophisticated cryptocurrency-focused stealer that also performs credential theft, surveillance, and traffic interception. The malware is delivered as compiled V8 bytecode in `.jsc` files, protected by the `javascript-obfuscator` tool, which employs techniques such as RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers.
JSCeal campaigns have been active since March 2024, with Check Point Research focusing on its delivery chain and targeting in a July 2025 publication. The current research details the analysis of the final payload, which presents a challenge due to its heavily obfuscated JavaScript being compiled into V8's internal bytecode, a format that is version-specific and not well-supported by standard reverse-engineering tools. Other vendors have also identified this malware under the names WEEVILPROXY or MeadowLocust.
The attackers leverage Node.js and its package ecosystem for application building blocks and use public tools like `javascript-obfuscator` for source-level obfuscation before compilation, making the resulting artifact inexpensive to produce. The final `.jsc` payload is distributed in Brotli-compressed form and decompressed by a `preflight.js` script, then executed by a bundled Node.js runtime.
The infection chain typically begins with malvertising, followed by multiple PowerShell scripts. The final stage involves downloading two ZIP archives: `node.zip`, containing a packaged Node.js runtime, and `build.zip`, which includes the `app.jsc` malware payload, `preflight.js`, and supporting components like `winpty-agent.exe` and `winpty.dll` for hidden console interaction, as well as native `.node` modules. The command `.\node.exe -r .\preflight.js .\app.jsc` triggers the loading of the malware.
To overcome the challenges of analyzing the compiled V8 bytecode, Check Point Research developed a fully static deobfuscation pipeline. This pipeline transforms View8 pseudocode without executing the malware, allowing for detailed analysis, comparison between samples, and tracking of the malware's evolution. An optional LLM-assisted renaming stage can further enhance readability of large, recovered codebases.
The foundation of this pipeline is View8, an open-source decompiler for V8 bytecode published by Moshe Marelus in 2024. Check Point Research extended View8 to ensure reproducible output suitable for automated post-processing and implemented dedicated passes for value propagation, string reconstruction, control-flow unflattening, proxy and operation-wrapper resolution, and additional cleanup. The goal was to recover enough structure and semantics to understand the malware's logic, identify capabilities, and validate behavior against concrete strings, APIs, paths, and data flow.
The deobfuscation process begins with decompressing the Brotli-compressed `.jsc` payload to obtain the V8 code cache. This cache is then fed into a compatible disassembler, and the disassembled output is processed by the View8-based pipeline. This pipeline, developed on Linux, includes multiple deobfuscation passes, each usable as a self-contained script. To support modularity, View8 was extended with pickle serialization of its internal object graph, function-level visibility controls, and metadata annotations.
The toolkit, named `jsc_deobfuscator`, is publicly available on GitHub. Check Point Research applied this pipeline to 23 JSCeal payloads collected over several months, successfully producing analyzable output in all cases. The deobfuscated output revealed JSCeal's capabilities, including keylogging, browser and cryptocurrency credential theft, screenshot capture, and HTTPS traffic interception through a local Man-in-the-Middle (MITM) proxy.
Recent developments in JSCeal include the generation of V8 code caches for newer Node.js/V8 versions, an additional payload-encryption layer, and targeting of macOS systems. This research was presented at Black Hat USA 2026, with the article providing a more in-depth technical methodology and implementation details.
