Sophisticated Malware Bypasses Google Authentication with Stolen Cookies

Cybersecurity researchers have uncovered JSCeal, a sophisticated compiled V8 JavaScript malware that can bypass Google authentication using stolen session cookies. The threat actors use fake cryptocurrency trading sites to trick unsuspecting users into downloading malicious software.

JSCeal is protected with javascript-obfuscator, which makes analysis and reverse-engineering harder. Check Point Research developed a deobfuscation pipeline to decode the malware's bytecode, revealing its execution flow and features.

The browser-stealing module targets Chromium-based browsers, including Google Chrome, Microsoft Edge, and Brave, extracting cookies and passwords from user profiles. JSCeal can also leverage stolen cookie data to conduct active session replay attacks and gain unauthorized access to a victim's Google account.