New JSCEAL Attack Targets Crypto App Users to Steal Credentials and Wallets

Security researchers at Check Point Research (CPR) have uncovered an extensive ongoing cybercrime operation targeting cryptocurrency users, dubbed “JSCEAL.”

This campaign leverages sophisticated tactics involving malicious advertisements and social engineering to distribute malware-laden installers that impersonate nearly 50 leading crypto trading platforms.

The malicious push primarily uses paid ads on social media, especially Facebook, drawing victims into downloading fraudulent applications.

These have made significant impacts, as evidenced by the estimated 35,000 malicious ads resulting in millions of impressions in the European Union during the first half of 2025.

Analysts believe the campaign’s global visibility could reach well over 10 million users, given the inclusion of institutions based in Asia and elsewhere.

Stealthy Infection Chain

The infection sequence begins with misleading ads redirecting victims to attacker-controlled sites via specially crafted domain chains.

These sites serve fake crypto trading applications and employ advanced filtering mechanisms to only reveal malicious content to qualified targets.

Victims who proceed are prompted to download an MSI installer, crafted using the WIX Toolset, which deploys multiple custom-made DLLs.

Notably, the campaign separates critical functionality between the installer and JavaScript hosted on the adversary’s site, requiring both to run simultaneously a tactic that significantly complicates malware detection and static analysis.

Upon execution, the installer establishes communications on localhost, interacts with the browser, and deploys persistence mechanisms through scheduled Windows tasks.

The malware chain disables Windows Defender monitoring for its files and initiates a PowerShell-based profiling phase.

This phase collects system details, software inventories, and networking configurations, exfiltrating them back to attacker infrastructure. If a victim is deemed high-value, operators deploy the final payload encapsulated in a ZIP archive.

This contains a Node.js runtime and the highly obfuscated JSCEAL malware compiled as JavaScript bytecode (JSC) an approach designed to evade static detection and frustrate code analysis.

Compiled Obfuscation

The JSCEAL payload marks a notable shift in cybercriminal methodology, abusing Google V8’s ability to run compiled JavaScript files to evasively load malware.

Once operational, JSCEAL establishes secure DNS-over-HTTPS connections for C2 communications and sets up a tRPC WebSocket for event-driven attacker control.

Its features are wide-ranging: from browser cookie harvesting, password theft, Telegram account compromise, and screen capturing, to full browser automation using embedded Puppeteer.

Critically, JSCEAL acts as both an information stealer and remote access trojan (RAT), with the ability to intercept and manipulate web sessions, install local proxies, and execute remote attacker commands using PowerShell and other native tools.

To deepen evasion and persistence, the campaign’s final-stage malware injects itself into user browsing sessions (man-in-the-browser) and manipulates crypto wallet extensions, capturing credentials and private keys in real time.

Most binaries in the attack chain installers and DLLs are signed with legitimate but likely fraudulently acquired code-signing certificates, many attributed to Russian non-IT firms.

The JSCEAL operation highlights the cybercriminal ecosystem’s growing adoption of modular, cross-platform frameworks like Node.js, enabling easy deployment of advanced malware in environments traditionally overlooked by defenders.

Compiled JavaScript payloads heavily obfuscated and modular present significant challenges for conventional endpoint protection and static detection tools.

According to the report, Check Point has updated its security products to detect and block JSCEAL and related artifacts, providing coverage under the identifiers InfoStealer.Win.JSCeal.A and Dropper.Wins.JSCEAL.ta.C.

Nonetheless, users are urged to remain vigilant, avoid downloading applications from non-official sources, and ensure endpoint security controls are up-to-date.

The campaign serves as a stark reminder that threat actors continue to innovate rapidly, making the need for proactive and adaptive security measures more critical than ever for individuals and organizations active in the cryptocurrency ecosystem.

Indicators of Compromise (IOCs)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates