JSCeal malware hides crypto theft in Chrome's code
JSCeal is a crypto-stealing malware that hides its code in Chrome's internal JavaScript format, making it harder to detect. It uses a Node.js runtime to run the stolen code without ever showing the original script.
- Report priority
- Medium
- Involves
- Node.js
What is known
- JSCeal starts with normal JavaScript code that steals cryptocurrency.
- But instead of sending that code directly to victims, the attackers first hide it inside Chrome's internal JavaScript format (called V8 bytecode).
- This bytecode is then bundled with a Node.js program that runs it on the victim's computer.
- Since the original JavaScript is never sent or seen, most malware scanners miss it.
- The attackers also use extra tricks like heavy obfuscation to confuse analysis tools.
What to do
If you've opened a file with a.jsc extension or a bundled Node.js program from an untrusted source, check for suspicious Node.js processes running in your Task Manager (Windows) or Activity Monitor (macOS). If you see unknown programs accessing your crypto wallets or browser extensions, stop all Node.js processes immediately. No update or patch fixes this, you must remove the malware manually.
Delete any.jsc files or suspicious Node.js bundles. Use Check Point's decompiler tool (linked in their report) to analyze and remove the malware. Report the incident to your crypto exchange or wallet provider if your accounts were accessed. No software update fixes this, manual cleanup is required.
Reported details
An attacker sends a fake cryptocurrency wallet update to a victim's computer. When the victim opens it, the program secretly runs Node.js with hidden V8 bytecode. This code then steals cryptocurrency from the victim's accounts without leaving obvious signs in normal malware scans.
JSCeal is a cryptocurrency-stealing malware that evades detection by embedding its payload in V8 bytecode, the compiled, low-level format used by Chrome and Node.js to execute JavaScript efficiently. Instead of delivering traditional JavaScript, attackers package the malware as a .jsc file alongside a bundled Node.js runtime, ensuring the original source code never reaches the victim's system. This bypasses most JavaScript analysis tools, which rely on source code rather than compiled bytecode.
The malware's obfuscation is layered: the JavaScript is first heavily obfuscated with a commercial-grade tool, then compiled into V8 bytecode, making reverse engineering difficult. The payload uses encrypted chunks, scrambled logic, and a state machine to obscure its operations, requiring specialized tools to decompile and analyze. Researchers at Check Point disclosed this technique in early 2025, noting it targets cryptocurrency applications and has been tracked under names like WEEVILPROXY or MeadowLocust.