JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

Cybersecurity researchers unpacked JSCeal, a sophisticated compiled V8 JavaScript malware with credential harvesting, surveillance, and traffic-interception capabilities. Check Point Research said the payloads are protected with javascript-obfuscator, using techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers, enabling it to bypass Google authentication using stolen session cookies.