Executive Summary
Since early 2025, Check Point Research has been tracking JSCeal, a sophisticated infostealer delivered as compiled V8 JavaScript bytecode. Explicitly attributed to clusters known as WEEVILPROXY or MeadowLocust, the malware targets retail traders and cryptocurrency investors across 12 countries. The campaign utilizes malvertising on Facebook and Google, redirecting victims to counterfeit trading sites like Solana and TradingView to deliver malicious Node.js bundles.
Technically, JSCeal is distinct for its use of the SourTrade assembly method, where malware is constructed directly in memory on the victim's machine. The payload is heavily protected using javascript-obfuscator, employing RC4 encryption and control-flow flattening to frustrate analysis. Once active, it enumerates Chromium-based browsers to extract credentials, OAuth tokens, and session cookies, which it then uses in active session replay attacks to bypass Google's authentication challenges.
This threat represents a significant risk to the financial and cryptocurrency sectors, as it combines surveillance capabilities (keylogging, screenshots) with a local HTTPS interception proxy. The actor's ability to manipulate traffic for platforms like Binance and Bybit allows for the direct theft of funds and account takeovers by bypassing modern security measures.