JSCeal Crypto Stealer Uses V8 Bytecode to Steal Browser Credentials and Intercept HTTPS

Gbhackers •Mayura Kathir • September 1, 2026

A sophisticated cryptocurrency-focused information stealer that hides its malicious logic inside compiled V8 JavaScript bytecode. JSCeal, also tracked by some vendors as WEEVILPROXY or MeadowLocust, is not delivered as readable JavaScript. Instead, operators package the final payload as a .jsc file compiled V8 bytecode executed with a bundled Node.js runtime. This approach frustrates conventional JavaScript […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

JSCeal Crypto Stealer Exploits Compiled V8 Bytecode for Credential Theft JSCeal is a sophisticated information stealer targeting cryptocurrency applications, delivered as compiled V8 bytecode (.jsc) executed by a bundled Node.js runtime. It has been active since March 2024 and is also known as WEEVILPROXY or MeadowLocust. The malware's obfuscation technique complicates detection and analysis, making it a significant threat to users of cryptocurrency platforms. Check Point Research has been monitoring this malware closely, providing insights into its operation and deobfuscation methods. The attack primarily affects users who interact with cryptocurrency wallets and exchanges, potentially leading to unauthorized access to sensitive information. Current mitigation strategies are limited due to the complexity of the malware's delivery method. 5 sources 58

Extracted Entities

JSCeal Crypto Stealer Uses V8 Bytecode to Steal Browser Credentials and Intercept HTTPS

The full story

Extracted Entities

Attack Types (1)

Malware (3)

MITRE ATT&CK (2)

Tools (1)