Breaking the Seal: Static Deobfuscation of JSCeal's Compiled V8

Executive Summary

Check Point Research (CPR) has published a static deobfuscation pipeline for JSCeal, a sophisticated cryptocurrency-focused stealer that operates as compiled V8 bytecode (.jsc files). The malware, active since March 2024, is delivered via malvertising and executed by a bundled Node.js runtime. CPR's new toolkit, jsc_deobfuscator, is publicly available and enables analysts to recover actionable pseudocode without executing the malware. This development significantly lowers the barrier to analyzing JSCeal variants, which previously required dynamic analysis or manual reverse-engineering of V8 bytecode.

Technical Analysis

JSCeal is a stealer that targets cryptocurrency applications, though it also includes broader credential-theft, surveillance, and traffic-interception capabilities. Its payloads are protected with javascript-obfuscator, employing RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers. The final payload is compiled into V8's internal bytecode representation, making it version-specific and resistant to standard JavaScript deobfuscation tools.

CPR's methodology builds on View8, an open-source decompiler for V8 bytecode, which they extended to produce reproducible output suitable for automated post-processing. The pipeline includes passes for value propagation, string reconstruction, control-flow unflattening, and resolution of proxy and operation wrappers. An optional LLM-assisted renaming stage helps navigate large recovered codebases.

The deobfuscated output allowed CPR to analyze JSCeal's capabilities in detail, including keylogging, browser and credential theft, and HTTPS traffic interception via a local MITM proxy. The research was presented at Black Hat USA 2026, and this article documents the methodology with additional technical depth.

Recent JSCeal developments include V8 code caches for newer Node.js/V8 versions, an additional payload-encryption layer, and macOS targeting. The malware's delivery chain involves PowerShell scripts that download two ZIP archives: a packaged Node.js runtime and a build containing the payload, a decompression script, and native .node modules. The final JSC payload is Brotli-compressed and decompressed by preflight.js before execution.

Indicators of Compromise

No specific IOCs (hashes, IPs, domains) were provided in the source material. However, analysts should monitor for .jsc files, winpty-agent.exe, winpty.dll, and the command line node.exe -r preflight.js app.jsc as potential indicators of JSCeal activity.

Tactics, Techniques & Procedures

JSCeal's TTPs include execution via Node.js (T1059.007), keylogging for credential access (T1056.001), and HTTPS interception through a local MITM proxy (T1557). The malware's use of compiled V8 bytecode is a novel evasion technique that complicates static analysis.

Threat Actor Context

JSCeal is a malware family tracked by Check Point Research since early 2025, with campaigns dating back to March 2024. Other vendors refer to it as WEEVILPROXY or MeadowLocust. The actor behind JSCeal remains unidentified, but the malware's focus on cryptocurrency applications suggests financial motivation.

Mitigations & Recommendations

Defenders should focus on detecting the delivery chain, which begins with malvertising and involves multiple PowerShell stages. Network monitoring for suspicious Node.js executions and the presence of .jsc files can help identify infections. Since JSCeal intercepts HTTPS traffic via a local proxy, organizations should enforce certificate pinning and monitor for unexpected certificate authorities. The public release of jsc_deobfuscator allows security teams to analyze JSCeal samples and develop targeted detection rules.