JSCeal Malware Bypasses Google Authentication Using Stolen Session Cookies

Cybersecurity researchers have uncovered JSCeal, a sophisticated malware that can bypass Google authentication using stolen session cookies. The threat actor uses fake cryptocurrency trading sites to redirect unsuspecting users via malicious ads on Facebook and Google.

The campaign, which overlaps with the WEEVILPROXY and MeadowLocust clusters, targets retail traders and cryptocurrency investors in 12 countries across 25 languages. Malicious JavaScript delivered by the campaign assembles malware directly in memory without leaving a finished payload on the network.

JSCeal is protected using javascript-obfuscator, with multiple layers of transformations to obscure the malware's execution flow. The Israeli cybersecurity company Check Point Research developed a deobfuscation pipeline to decode compiled V8 JavaScript bytecode and reveal the malware's features, including its ability to enumerate installed browsers and query saved secrets.

The browser-stealing module targets Chromium-based browsers, extracting cookies and passwords from available profiles. JSCeal can also leverage stolen cookie data to reconstruct a browser session and conduct active session replay attacks to bypass authentication.