"What makes SourTrade technically distinct is what happens on its landing page," Confiant said. The phrase captures a shift in how a sophisticated JavaScript-based malware family, known as JSCeal, is being assembled and deployed to target retail traders and cryptocurrency users.
How SourTrade and malvertising deliver JSCeal
Security firms tracing this activity report a layered distribution chain that begins with malvertising. Users are redirected by malicious ads on Facebook and Google to counterfeit trading sites that impersonate legitimate brands. Those lookalike portals—Confiant named examples such as Solana, Luno, and TradingView—either instruct visitors to download bogus installers for TradingView or deliver assembly instructions that cause the browser to build malware in memory.
Confiant described the campaign codenamed SourTrade as delivering "assembly instructions to the victim's browser, retrieve[ing] a clean legitimate file from separate infrastructure, and direct[ing] the browser to build the final malware in memory on the victim’s machine. No finished malware ever exists on the network." Check Point Research noted JSCeal was first documented in July 2025, and other vendors, including Bitdefender, have observed overlapping activity.
The distribution chains sometimes use two ZIP archives delivered via PowerShell: one archive containing the Node.js runtime and the other holding the main payload and auxiliary components.
JSCeal's credential theft, session replay, and surveillance
Check Point Research's technical analysis shows JSCeal as a compiled V8 JavaScript (JSC) payload with multiple modules for credential harvesting, surveillance, and traffic interception. The malware's browser-stealing module targets an explicit list of Chromium-based browsers: Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Avast Secure Browser, Vivaldi, and Cốc Cốc.
For each targeted browser, JSCeal navigates to the expected user-data directory, enumerates available profiles, and extracts cookies and saved passwords. Using the stolen cookie data, the malware can "reconstruct a browser session and conduct active session replay attacks to bypass authentication and gain unauthorized access to a victim's Google account," the report states. A separate surveillance module records keystrokes and captures screenshots.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageObfuscation, compiled V8 format, and Check Point's deobfuscation work
Operators protect JSCeal with javascript-obfuscator and apply repeated transformation groups to make analysis harder. Check Point enumerated four families of transformations:
- Replacing function and variable names with short or nonsensical identifiers;
- Splitting important strings into encoded, RC4-protected chunks that are later reassembled by decoder functions;
- Using control-flow flattening to convert program flow into a single-level switch statement governed by an infinite loop and state variable;
- Forwarding calls through proxy helpers and wrapping simple operations in dedicated helper functions.
Those techniques are applied before compilation into a version-specific compiled V8 format. Check Point said it developed a "fully static deobfuscation pipeline" to decode that compiled bytecode, thereby revealing execution flow and the malware’s features, including the browser enumeration and the "router" functions that register handlers for collected information.
Security researcher Aleksandra "Hasherezade" Doniec summarized the combined effect as moving JSCeal "outside the workflows that analysts normally rely on," while noting that "neither" obfuscation nor the compiled format "makes the malware impossible to reverse."
Proxy functions and cryptocurrency-specific handlers
Beyond theft and surveillance, recovered code indicates JSCeal installs local proxy functionality, generates and installs certificates, and modifies selected web requests and responses. Check Point reported that the proxy is not limited to passive interception; it contains dedicated handlers to alter requests and responses for specific services.
A configuration function exposes overrides for Binance, Bybit, and Ledger, as well as generic handlers for replacing HTML, blocking hosts, and clearing selected cookies. Multiple handlers are focused on cryptocurrency platforms—one specifically captures account data and records cryptocurrency balances—underscoring the campaign’s targeting of crypto traders.
What this means for technologists, retail traders, and advertising platforms
- Technologists and security teams: Analysts must contend with a combination of javascript-obfuscator transformations and a version-specific compiled V8 format. Check Point’s "fully static deobfuscation pipeline" is one response, but the report implies that these techniques raise analysis friction and require tooling that can decode compiled JSC bytecode before conventional workflows identify malicious behavior.
- Retail traders and cryptocurrency investors: The campaign targets this group directly—active since late 2024, the operation has been observed across 12 countries in 25 languages, "primarily in Asia Pacific and Latin America." Affected users are redirected from malvertising to lookalike trading portals and may be asked to install bogus TradingView installers or be exposed to in-browser assembly routines that never write a finished binary to the network.
- Advertising platforms and publishers: Confiant’s findings underline that malvertising can impersonate well-known trading and cryptocurrency brands to steer victims to in‑memory assembly flows. Platforms and publishers serving ads will face pressure to detect and disrupt these lookalike landing pages and the malicious ad flows that lead to them.
Taken together, the published analyses show an actor investing in both evasive delivery (in‑memory assembly, malvertising) and in-depth obfuscation and cross-browser extraction capabilities. Check Point’s finding that JSCeal continues under active development, combined with Confiant’s observation of SourTrade’s in‑browser assembly, leaves a clear question for defenders and platform operators: can detection and remediation keep pace with malware that is built inside a victim's browser and protected by layered obfuscation?
Source: https://thehackernews.com/2026/09/jsceal-malware-can-bypass-google.html
