Check Point Research published a deep technical breakdown on August 31 of JSCeal, a credential-stealing malware family it has tracked since early 2025, revealing that the malware’s session-hijacking module can reconstruct a victim’s browser session from stolen cookies well enough to bypass Google account authentication entirely, no password or multi-factor prompt required.
JSCeal spreads through malicious ads on Facebook and Google that redirect victims to fake cryptocurrency trading sites, which push bogus TradingView installers bundling a Node.js runtime alongside the malware payload. What makes it hard to catch is not the delivery, it is the packaging: the payload ships as compiled V8 JavaScript bytecode rather than readable source, wrapped in additional obfuscation, a format Check Point says “is poorly served by mature reverse-engineering tooling.” Researchers had to build a custom static deobfuscation pipeline just to read what the malware does.
What it does, once decoded, is broader than credential theft. Beyond the session-replay attack that hands over a live, authenticated Google session using stolen cookies, JSCeal installs a local proxy with its own generated certificates to intercept and modify HTTPS traffic, with dedicated handlers Check Point identified for Binance, Bybit, and Ledger, plus generic tools for blocking hosts and clearing targeted cookies. A separate module logs keystrokes and takes screenshots. For the security leader, the original insight is not that session-cookie theft can bypass MFA, that risk is established, it is that this malware treats browser session state as valuable enough to justify building certificate-generation and traffic-interception tooling around it, an investment usually associated with a banking trojan rather than a crypto-phishing kit.
Defenders should prioritize short-lived session tokens and continuous session risk scoring over point-in-time MFA checks, since a valid replayed cookie defeats a login prompt that already happened. Endpoint detection tuned to flag locally-installed proxy certificates and unexpected Node.js runtimes bundled with installers, a delivery pattern tracked in other recent credential-theft campaigns, would catch JSCeal before the session-replay stage. Node.js-based tooling is a recurring thread in access-broker malware this year, and teams should treat unexpected Node runtimes on end-user machines as a detection priority.
Source: Check Point Research
