This technical research article explores the analysis of JSCeal, a sophisticated info-stealer distributed as compiled V8 bytecode (.jsc) and executed via a bundled Node.js runtime. Unlike standard JavaScript malware, JSCeal employs multiple layers of source-level obfuscation before compilation, creating a significant barrier for security analysts. To address this, the researchers developed a specialized static deobfuscation pipeline based on the View8 tool, which successfully reconstructs readable pseudocode from the version-specific V8 code caches.
The research details a multi-stage deobfuscation process involving string reconstruction, control-flow unflattening, and the resolution of proxy functions and operation wrappers. By applying this pipeline to a dataset of 23 samples, the team was able to identify advanced malicious capabilities, including automated browser credential theft using Puppeteer, cryptocurrency balance monitoring for major exchanges, keylogging, and the deployment of a local HTTPS interception proxy with a custom-installed root certificate. The findings highlight how attackers are leveraging the Node.js ecosystem to create high-friction analysis environments and broaden their platform coverage.
