JSCeal OAuth token theft - crafted token endpoint request

Arnold Chan@slaz

•updated Sep 7, 2026•1•0•5

Detects anomalous outbound HTTP requests to the Google OAuth token endpoint that mimic the behavior of the JSCeal malware. The rule identifies requests that lack standard browser-based User-Agent strings and omit the 'code_verifier' parameter, which is typically required in legitimate PKCE-enabled OAuth flows, indicating potential automated token theft.