A new strain of malware named JSCeal has emerged as a formidable threat to Google account security. It bypasses two-factor authentication by stealing session cookies and replaying them, letting attackers log in as users without needing passwords or codes.
Discovered in 2025 but still active as of late 2026, JSCeal is distributed through malvertising campaigns targeting cryptocurrency traders and retail investors. Victims are lured in via fake trading sites—often after clicking malicious ads on social platforms—which prompt them to download fraudulent installers. Once executed, these installers deploy the malware component that carries out a suite of stealthy operations.
How JSCeal Works
JSCeal begins by delivering two ZIP archives via PowerShell: one with Node.js runtime, the other loaded with the core payload and support files. The main payload is compiled V8 JavaScript. Before compilation, it’s heavily obfuscated using techniques like RC4-encrypted string fragments, control-flow flattening, proxy functions, and wrappers to thwart analysis.
Once active, JSCeal scans for Chromium-based browsers—Chrome, Edge, Opera variants, Brave, Vivaldi, Avast Secure, among others—and explores their user-data directories. It then extracts cookies, passwords, OAuth tokens, and other credentials. With session cookies in hand, it replays sessions to access Google services without triggering authentication checks, bypassing both passwords and two-factor routines.
Additional Capabilities & Campaign Footprint
Beyond session hijacking, JSCeal includes surveillance tools. It can record keystrokes, take screenshots, and intercept or modify network traffic. Specific handlers target cryptocurrency platforms, enabling the malware to monitor balances and account information. It also uses proxy mechanisms—installing local certificates and modifying web requests—to inject content or block hosts as needed.
The malware is linked to a broader malvertising campaign called SourTrade, which in late 2024 began impersonating brands like Solana, TradingView, and Luno. In multiple countries across Latin America and Asia Pacific, it has presented phishing lookalike sites, delivered JS-based loaders in memory, and avoided storing full malware binaries on disk. Analysts believe there’s overlap between SourTrade and earlier JSCeal activities identified by Bitdefender in 2025.
Researchers developed a deobfuscation pipeline for this compiled V8 JavaScript, revealing how the malware is structured and executed—despite layers of defenses. The combined effect of version-specific bytecode and strong obfuscation aims to push JSCeal outside typical malware analysis workflows and slow response efforts.
Security experts warn this evolution signals an escalation: threat actors aren’t just refining their infiltration tactics—they’re investing in staying hidden while broadening their reach.
What this means going forward is clear: defenses must adapt. Organizations and individuals should treat session cookies as sensitive credentials, enforce strict browser isolation, limit admin privileges for local certificates, and ensure robust endpoint monitoring. Threat detection teams need to prepare for malware that doesn’t leave obvious footprints—especially when it comes to JavaScript-based payloads that execute in memory. JSCeal reminds us that authentication isn’t just about passwords and 2FA anymore—it’s about the full stack of session security.
