JSCeal Steals Chromium Cookies to Replay Google Sessions via V8 Bytecode

The malware arrives through malvertising on Facebook and Google that redirects users to fake TradingView download pages. Two ZIP archives deliver a Node.js runtime and obfuscated V8 JavaScript payload compiled with javascript-obfuscator. Control-flow flattening, RC4 string protection, and proxy wrappers prevent static analysis. Once running, JSCeal enumerates browser user-data directories, reads SQLite cookie stores, and reconstructs authenticated sessions for google.com domains. Check Point documented the campaign in July 2025; Confiant independently mapped the same SourTrade infrastructure active since late 2024 across 25 languages. Bitdefender’s September 2025 note on in-memory assembly overlaps technically with both reports. No finished binary traverses the network, reducing detection surface. Session replay succeeds because Google cookies remain valid for weeks and lack binding to device attestation in consumer accounts. The operation targets retail traders in Asia-Pacific and Latin America, harvesting not only credentials but router modules for further data exfiltration. Overlap with WEEVILPROXY and MeadowLocust clusters suggests shared tooling rather than confirmed single actor. Procurement records and ad-platform takedowns remain the only verifiable disruption vectors. Next indicators will appear in fresh malvertising clusters impersonating additional trading platforms. Expect expanded browser targets once deobfuscation pipelines leak.