Static Deobfuscation Defeats JSCeal Cryptocurrency Malware Defenses

by Nam Phong · Published September 2, 2026 · Updated September 1, 2026

A conceptual image illustrating the static deobfuscation process extracting readable pseudocode from the JSCeal compiled V8 bytecode malware

Compiled code no longer functions as an impenetrable shell protecting JSCeal. Check Point specialists recently developed a fully static deobfuscation method. This innovative technique effectively transforms the hidden malware into readable pseudocode. Crucially, it accomplishes this without requiring dynamic execution. The team rigorously tested this method against 23 distinct samples collected over several months. They successfully produced highly readable results in every single instance.

The Threat of JSCeal

JSCeal, frequently identified as WEEVILPROXY or MeadowLocust, aggressively targets cryptocurrency service users. This sophisticated malicious campaign has remained highly active since at least March 2024. The attackers primarily distributed counterfeit applications through deceptive advertising networks. They subsequently executed the final malicious payload utilizing an embedded Node.js environment. Check Point researchers have meticulously tracked this specific malware family since early 2025.

Overcoming Double Obfuscation

Conventional analysis tools struggled significantly when analyzing JSCeal. This difficulty stemmed directly from its robust double-masking techniques. The developers initially tangled the underlying JavaScript code. Later, they aggressively compiled it directly into internal V8 bytecode. The resulting compiled cache depended entirely upon the specific engine version utilized. Furthermore, it completely lacked numerous original source code elements. Standard deobfuscation tools inherently rely upon these missing elements to function correctly.

The New Deobfuscation Pipeline

The newly developed analysis chain operates systematically. First, it carefully unpacks the initial file, which the developers compressed utilizing the Brotli algorithm. Next, it seamlessly transfers the extracted cache directly to the compatible View8 disassembler and decompiler. Sequential processing modules then systematically restore hidden values and encrypted strings heavily protected by RC4. They also meticulously straighten the deliberately tangled execution order. Finally, they remove redundant intermediary functions. The researchers generously published this complete toolset directly on GitHub.

Unveiling Hidden Capabilities

The resulting sanitized pseudocode finally revealed JSCeal’s comprehensive capabilities. Many of these functions might never manifest during a single, isolated dynamic test execution. The malware aggressively intercepted keystrokes and captured detailed screenshots. It stealthily stole passwords, session cookies, browser data, and sensitive Telegram information. A localized proxy server intercepted and maliciously manipulated HTTPS traffic utilizing a controlled, fraudulent certificate. Additionally, specialized handlers systematically collected user balances across 25 distinct cryptocurrency platforms.

Evolving Malware Tactics

The developers behind JSCeal continually complicate subsequent analysis efforts. Recent variants introduced a completely different version of the underlying V8 engine. They also incorporated supplementary AES-256-CBC encryption. This encryption utilizes a specific key derived directly from the previous infection stage. Furthermore, the malware now actively supports macOS environments. The currently released analyzer version specifically targets the older V8 build. However, Check Point definitely plans to add support for the newer version later. Artificial intelligence can potentially assign comprehensible names to obscure functions. Nevertheless, such AI-generated suggestions still require meticulous manual verification against the core code and data flows.