[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDOYIIeFD96xyDOCi_L_W8Loj7weehrZTk21UtuplPvU":3},{"article":4,"iocs":53,"watch_terms":65,"solutions":66,"lesson":167},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"5e044c34-3ccc-466e-8636-67ec0db4a024","JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies","jsceal-malware-can-bypass-google-authentication-using-stolen-session-cookies-459bb4","Cybersecurity researchers have unpacked JSCeal, a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-interception capabilities. \"The payloads are protected with javascript-obfuscator, using multiple techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers,\" Check Point Research said in a","JSCeal is a sophisticated V8 JavaScript malware capable of credential harvesting, surveillance, and traffic interception. It uses advanced obfuscation techniques and targets Chromium-based browsers to steal session cookies and reconstruct browser sessions for active replay attacks. The malware is distributed via malvertising campaigns impersonating trusted brands, often assembling the final payload directly in memory on the victim's machine.","JSCeal malware steals session cookies to bypass Google authentication.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fjsceal-malware-can-bypass-google.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEilF0_vQTn1mpUhivH8aX0vt8SA_Y5wkJqpHriuAdDQKVuWON7ZSzOAbWlwm50oxWlOJ5wMdzBjzy1wRVGNL6IqY8eYFUlIyayK6aiwcXK1fTO9JWZ9hG_QYrNnY_fdm2Lu7Z87p0JOR4WkYD2HNK-6WlcJQgxmUsG1k8k3ye5AT1ggaoiIDAm0kHxYQJ6V\u002Fs1600\u002Fchrome-cookies.jpg","2026-09-07T07:53:04+00:00","2026-09-07T10:00:14.796619+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"TradingView","product",{"name":21,"type":19},"Google Chrome",{"name":23,"type":19},"Microsoft Edge",{"name":25,"type":19},"Brave",{"name":27,"type":19},"Opera",{"name":29,"type":19},"Opera GX","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57,60,62],{"type":34,"value":55,"context":56},"JSCeal","Name of the malware analyzed",{"type":34,"value":58,"context":59},"WEEVILPROXY","Threat cluster name overlapping with JSCeal activity",{"type":34,"value":61,"context":59},"MeadowLocust",{"type":34,"value":63,"context":64},"SourTrade","Malvertising campaign name distributing JSCeal",[18,21,23],{"controls":67,"vendors":155},[68,97,126],{"slug":69,"name":70,"problem":71,"products":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":98,"name":99,"problem":100,"products":101},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"slug":127,"name":128,"problem":129,"products":130},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[156,162],{"slug":157,"name":158,"logo_path":159,"roles":160},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png",[161],"reported_by",{"slug":163,"name":164,"logo_path":165,"roles":166},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png",[161],{"slug":168,"title":169,"body":170,"framework_refs":171,"framework_notes":183},"jsceal-malware-hijacks-google-sessions-via-stolen-browser-cookies","JSCeal Malware Hijacks Google Sessions via Stolen Browser Cookies","JSCeal malware exploits a fundamental weakness in session-based authentication: once a valid session cookie is stolen, attackers can bypass multi-factor authentication entirely and impersonate legitimate users in real time. The malware spreads through malvertising campaigns that mimic trusted brands, preying on users who cannot distinguish malicious ads from legitimate content. By executing entirely in memory and targeting Chromium-based browsers, it evades traditional file-based detection tools. This attack demonstrates that strong passwords and even MFA alone are insufficient if session tokens are not also protected — credential theft has evolved well beyond username and password capture.",[172,173,174,175,176,177,178,179,180,181,182],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-63B Section 7.1 – Session Management","NIST AC-12: Session Termination","NIST SI-3: Malicious Code Protection","NIST PR.AT-1: Security Awareness and Training","GDPR Article 32 – Security of Processing (appropriate technical measures)","MITRE ATT&CK T1539: Steal Web Session Cookie","MITRE ATT&CK T1185: Browser Session Hijacking","ITIL Service Operation – Incident and Problem Management",{}]