Malware that steals browser credentials usually ships them somewhere else. Check Point has published recovered code showing that JSCeal, a cryptocurrency stealer, instead spends them on the infected machine, replaying stolen cookies against Google’s own login flow to obtain a fresh OAuth token.
The research, published Aug. 31, 2026, documents a static deobfuscation pipeline applied to 23 JSCeal payloads collected over several months. The capability analysis comes from one selected sample, whose delivery campaign Microsoft and Cato Networks have separately documented.
JSCeal does not download a Chromium build of its own. It launches one of the browsers already installed on the machine, using the executable paths and profiles its browser module has discovered, and runs it in Puppeteer’s headless shell mode.
Cookies recovered from the victim’s profile are injected into a new page, which is pointed at Google’s Android authentication endpoint. The malware then enumerates the Google accounts visible in that session.
For each account it finds, JSCeal looks up passwords pulled from the same host and tries them in turn against the login challenge. On success, it reads the resulting token out of the browser’s cookies and saves it with the scope marked for Android.
Check Point said stealth plugins and the ghost-cursor library are also loaded, which it reads as an attempt to make the automation resemble ordinary browsing. Its finding rests on statically recovered code, rather than an observed compromise, and it does not say how reliably the sequence clears Google’s defenses.
That changes the nature of the theft. JSCeal still ships cookies and password databases out to its operator, but the recovered code shows the same material being reused on the machine it came from, driving a browser the victim already has installed to produce a token the operator did not have before.
The payload is also getting harder to reach
The generation Check Point analyzed in depth ran on a bundled Node.js runtime carrying V8 10.2.154.26-node.25. By late October 2025 the authors were already making the payload harder to find, renaming it to an ordinary application filename that left the contents unchanged but, the company said, rendered hunting based on the .jsc extension ineffective.
It is the same problem a Windows loader carrying AZALEA RAT posed to antivirus engines in August: a clean verdict on the file says little when the thing you are looking for has moved.
Campaigns from early November 2025 moved to V8 13.6.233.10-node.28. Code caches built for it proved far more sensitive to the exact build and snapshot configuration, making a compatible standalone disassembler harder to obtain.
The authors then wrapped the compressed payload in an AES-256-CBC layer. The key is not held in the bundle. Another stage of the deployment chain supplies it, so recovering the bytecode requires the surrounding infection chain, rather than an isolated payload.
Check Point said it had also observed campaigns targeting macOS. The toolkit it released still targets the older runtime generation, with support for the newer one planned for a future release.
The capability was disclosed at Black Hat USA in August 2026; the paper supplies the code behind it. Check Point’s earlier work on JSCeal, published in July 2025, covered the campaigns and delivery chain rather than the payload.
