JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies
JSCeal malware steals session cookies to bypass Google authentication.
JSCeal is a sophisticated V8 JavaScript malware capable of credential harvesting, surveillance, and traffic interception. It uses advanced obfuscation techniques and targets Chromium-based browsers to steal session cookies and reconstruct browser sessions for active replay attacks. The malware is distributed via malvertising campaigns impersonating trusted brands, often assembling the final payload directly in memory on the victim's machine.
AI summary of the linked source. Not reviewed by an editor. How this works
Run TradingView?
Get an email when a new story names TradingView, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonJSCeal malware exploits a fundamental weakness in session-based authentication: once a valid session cookie is stolen, attackers can bypass multi-factor authentication entirely and impersonate legitimate users in real time. The malware spreads through malvertising campaigns that mimic trusted brands, preying on users who cannot distinguish malicious ads from legitimate content. By executing entirely in memory and targeting Chromium-based browsers, it evades traditional file-based detection tools. This attack demonstrates that strong passwords and even MFA alone are insufficient if session tokens are not also protected — credential theft has evolved well beyond username and password capture.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — JSCeal
- malware — WEEVILPROXY
- malware — MeadowLocust
- malware — SourTrade