JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies
Summary: Check Point Research published a technical report on JSCeal, a compiled V8 JavaScript malware that harvests credentials, records keystrokes and screenshots, and sets up a local proxy to modify requests and responses for services including Binance, Bybit, and Ledger. The malware is distributed through fake cryptocurrency trading sites reached via malicious Facebook and Google ads, and it uses stolen cookies to reconstruct browser sessions and replay them to bypass authentication on Google accounts.
What's compelling: JSCeal's session replay means a stolen cookie is enough to get into a victim's Google account without a password, and its proxy handlers are built to alter what users see on Binance, Bybit, and Ledger - the three places where crypto holdings actually sit.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026