JSCeal Steals Cryptocurrency with Advanced V8 Bytecode Hiding Technique

JSCeal is a sophisticated cryptocurrency stealer that Check Point Research has been tracking since early 2025. It hides its code in V8 bytecode, making analysis much harder.

Unlike most malware, JSCeal compiles its JavaScript into V8 bytecode, packages it with a Node.js runtime, and executes it, leaving the original JavaScript on the attacker's server.

The researchers built a tool to decompile the hidden code and expose its advanced theft capabilities. They used an existing open-source V8 bytecode decompiler called View8 and extended it with a purpose-built pipeline specifically tuned to JSCeal's patterns.

The recovered code shows a genuinely broad toolkit built for financial theft, including stealing saved passwords and cookies from eight different Chromium-based browsers, harvesting Telegram session data, logging keystrokes, taking screenshots, and installing a locally generated, attacker-controlled certificate to intercept and modify HTTPS traffic in transit.