JSCeal Malware Bypasses Google Authentication via Stolen Session Cookies

Check Point Research has uncovered JSCeal, a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-interception capabilities. The malware's payloads are protected using javascript-obfuscator with multiple layers of obfuscation including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers.

The primary attack vector involves the theft and reuse of session cookies, which allows threat actors to bypass Google authentication mechanisms including multi-factor authentication. By reusing stolen session cookies, attackers can gain unauthorized access to Google accounts without needing credentials or bypassing MFA protections.

JSCeal demonstrates the evolving threat landscape where compiled JavaScript malware can effectively target browser-based authentication systems. The malware's ability to intercept traffic and harvest credentials combined with session cookie reuse presents a significant risk to account security.

Check Point Research notes that the use of obfuscation techniques makes detection and analysis more challenging, requiring enhanced monitoring and updated security controls to identify and mitigate such threats.