The file that lands on an analyst's desk at the end of a JSCeal infection is called app.jsc, and it is not JavaScript. It is compiled V8 bytecode, the internal format Google's JavaScript engine normally keeps to itself, shipped alongside a private copy of Node.js that knows how to run it.
That single design choice bought the malware years of quiet.
JSCeal is a cryptocurrency-focused stealer that also takes credentials, watches the user and intercepts web traffic. Check Point Research has tracked it since early 2025, and dates the campaign activity behind it back to March 2024. Other vendors track the same code as WEEVILPROXY or MeadowLocust. This week the researcher known as hasherezade published the methodology and the tooling for reading it, work the team presented at Black Hat USA 2026.
Two layers between the analyst and the code
The payload is protected twice over. First the JavaScript is run through javascript-obfuscator, a public tool, which encrypts strings with RC4, flattens the control flow and routes ordinary operations through proxy functions and wrappers. Then the result is compiled into a V8 code cache, a version-specific binary format that mature reverse-engineering tools do not handle and standard JavaScript analysis workflows cannot touch at all. Running it in a sandbox produced system-level telemetry but almost nothing about what the script was deciding.
Getting there in the first place takes a chain that starts with malvertising and passes through several PowerShell scripts, which pull down two archives: one containing a packaged Node.js build, the other holding the Brotli-compressed payload, a decompression script, native modules and a pair of open-source components used to drive a hidden Windows console. The final launch is a single command line that tells Node to run the decompression script before loading app.jsc.
A decompiler, extended until the output held still
The pipeline is built on View8, the open-source V8 bytecode decompiler published in 2024 by Check Point's Moshe Marelus. The team extended it so its output is reproducible and safe to post-process, then added passes that propagate values, rebuild the encrypted strings, unflatten the control flow and resolve the proxy and wrapper layers. An optional stage uses a language model to rename recovered symbols, which matters when the codebase is large enough to get lost in. The whole toolkit is public.
The researchers are careful about what this is. V8 compilation is lossy and the output stays pseudocode, so this is not source recovery. It is enough structure to read the malware as code again, compare samples and follow its evolution.
What was inside
The recovered code confirms browser and cryptocurrency wallet theft, credential theft, keylogging and screenshot capture, plus a local HTTPS interception proxy: a man in the middle running on the victim's own machine, positioned to read traffic that would otherwise be encrypted between the browser and the site. Newer samples add another payload encryption layer, code caches built for a more recent Node.js and V8 version, and macOS targeting.
Hunt for the runtime, not the script
For defenders the useful detail is the delivery shape rather than any single hash. A bundled node.exe executing a .jsc file from a user-writable directory, preceded by a PowerShell chain and a pair of downloaded archives, is unusual on an ordinary corporate endpoint and is visible in process telemetry regardless of how well the payload is obfuscated. IntelFusions has reported on the same trick with a different JavaScript runtime, which suggests the pattern is spreading rather than fading.
Selected sample hashes from the report, SHA-256: de213ebc44c614d0b2324787e267183dbbbbb19e1ad866435a322ee00e24e7b6 and c77b3b7a507162bfc03cfeb8ef18d5ee7017e8fcbd6d7e005f986a3c967b8d45.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.