--- title: Breaking the Seal: Static Deobfuscation of JSCeal’s... description: A deep technical breakdown describes how Check Point Research reverse-engineered JSCeal, a cryptocurrency-focused infostealer distributed as compiled V8... canonical: https://daily.dev/posts/breaking-the-seal-static-deobfuscation-of-jsceal-s-compiled-v8-bytecode-0whadga5u twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode | daily.dev og:description: A deep technical breakdown describes how Check Point Research reverse-engineered JSCeal, a cryptocurrency-focused infostealer distributed as compiled V8... og:url: https://daily.dev/posts/breaking-the-seal-static-deobfuscation-of-jsceal-s-compiled-v8-bytecode-0whadga5u og:image: https://api.daily.dev/og/posts/0wHadga5U.png og:image:alt: Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode **[Check Point Research](https://daily.dev/sources/cpresearch)** · 67 min read · 0 upvotes · 0 comments ## Summary A deep technical breakdown describes how Check Point Research reverse-engineered JSCeal, a cryptocurrency-focused infostealer distributed as compiled V8 bytecode (.jsc) run via a bundled Node.js runtime. Because the malware is both source-obfuscated (via javascript-obfuscator) and compiled to V8's version-specific bytecode cache, standard JS deobfuscation tools fail. The team extended the open-source View8 decompiler with custom passes for value propagation, string reconstruction (RC4 decryption, chunk reassembly), control-flow unflattening, and proxy/wrapper resolution, applying the pipeline to 23 collected payloads. They also built an optional LLM-assisted function-renaming stage (tested with Claude Sonnet 4.6 and GPT-5.4-mini), finding Sonnet produced usable names in 128/142 cases versus GPT's 30/142, while stressing that LLM output is a navigation hypothesis, not evidence. The case study reveals JSCeal's capabilities: browser credential/cookie/OAuth theft, keylogging, screenshot capture, Telegram session theft, and a local HTTPS interception proxy. The toolkit and datasets are released as open source. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is JSCeal malware and how does it evade analysis? JSCeal is a stealer targeting cryptocurrency applications, delivered as compiled V8 bytecode (.jsc) executed by a bundled Node.js runtime rather than as readable JavaScript source. It also tracked as WEEVILPROXY or MeadowLocust, with campaign activity dating to March 2024. Because the JavaScript is obfuscated before compilation and shipped as a version-specific V8 code cache, it resists conventional source-level JavaScript deobfuscation and instrumentation tools. _Malware researchers reverse-engineering obfuscated payloads can track emerging deobfuscation techniques on daily.dev._ ### What is View8 and how was it extended for JSCeal analysis? View8 is an open-source V8 bytecode decompiler originally published in 2024 by Check Point's Moshe Marelus. For JSCeal analysis, it was extended with pickle serialization of its internal object graph, deterministic function-identifier normalization, function-level visibility controls, metadata annotations, and dedicated passes for value propagation, string reconstruction, control-flow unflattening, and proxy/operation-wrapper resolution. _Reverse engineers evaluating decompiler tooling can follow tool updates like these via daily.dev._ ### How well did Claude Sonnet 4.6 compare to GPT-5.4-mini at renaming obfuscated malware functions? Across 142 selected function trees, Claude Sonnet 4.6 produced 128 correct and informative function names versus 30 for GPT-5.4-mini, with GPT identifying the right general behavior but too imprecisely in 90 additional cases. Across more than 21,000 total functions, the two models picked the exact same name only 9.3% of the time, though this measured naming agreement rather than semantic correctness. _Developers weighing LLMs for code understanding tasks can compare model results shared on daily.dev._ ## Similar posts on daily.dev - [Unmasking a Web3 Supply Chain Attack: Deobfuscating a 47-Wallet Stealer Hidden in Vite](https://daily.dev/posts/unmasking-a-web3-supply-chain-attack-deobfuscating-a-47-wallet-stealer-hidden-in-vite-bbose5mdk) · Coins Bench · 0 upvotes · 0 comments --- Tags: [#nodejs](https://daily.dev/tags/nodejs), [#malware](https://daily.dev/tags/malware), [#reverse-engineering](https://daily.dev/tags/reverse-engineering), [#v8](https://daily.dev/tags/v8) [View this post on daily.dev](https://daily.dev/posts/breaking-the-seal-static-deobfuscation-of-jsceal-s-compiled-v8-bytecode-0whadga5u) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode","url":"https://daily.dev/posts/breaking-the-seal-static-deobfuscation-of-jsceal-s-compiled-v8-bytecode-0whadga5u","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/breaking-the-seal-static-deobfuscation-of-jsceal-s-compiled-v8-bytecode-0whadga5u"},"datePublished":"2026-08-31T13:49:04.497Z","dateModified":"2026-08-31T13:49:39.682Z","description":"A deep technical breakdown describes how Check Point Research reverse-engineered JSCeal, a cryptocurrency-focused infostealer distributed as compiled V8...","image":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","thumbnailUrl":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","isAccessibleForFree":true,"articleSection":"Check Point Research","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Check Point Research","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/7e3b130555214df2bf737ee6c764fa42","url":"https://daily.dev/sources/cpresearch"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/breaking-the-seal-static-deobfuscation-of-jsceal-s-compiled-v8-bytecode-0whadga5u","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"nodejs,malware,reverse-engineering,v8","timeRequired":"PT67M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Check Point Research","item":"https://daily.dev/sources/cpresearch"},{"@type":"ListItem","position":3,"name":"Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/breaking-the-seal-static-deobfuscation-of-jsceal-s-compiled-v8-bytecode-0whadga5u#faq","mainEntity":[{"@type":"Question","name":"What is JSCeal malware and how does it evade analysis?","acceptedAnswer":{"@type":"Answer","text":"JSCeal is a stealer targeting cryptocurrency applications, delivered as compiled V8 bytecode (.jsc) executed by a bundled Node.js runtime rather than as readable JavaScript source. It also tracked as WEEVILPROXY or MeadowLocust, with campaign activity dating to March 2024. Because the JavaScript is obfuscated before compilation and shipped as a version-specific V8 code cache, it resists conventional source-level JavaScript deobfuscation and instrumentation tools. Malware researchers reverse-engineering obfuscated payloads can track emerging deobfuscation techniques on daily.dev."}},{"@type":"Question","name":"What is View8 and how was it extended for JSCeal analysis?","acceptedAnswer":{"@type":"Answer","text":"View8 is an open-source V8 bytecode decompiler originally published in 2024 by Check Point's Moshe Marelus. For JSCeal analysis, it was extended with pickle serialization of its internal object graph, deterministic function-identifier normalization, function-level visibility controls, metadata annotations, and dedicated passes for value propagation, string reconstruction, control-flow unflattening, and proxy/operation-wrapper resolution. Reverse engineers evaluating decompiler tooling can follow tool updates like these via daily.dev."}},{"@type":"Question","name":"How well did Claude Sonnet 4.6 compare to GPT-5.4-mini at renaming obfuscated malware functions?","acceptedAnswer":{"@type":"Answer","text":"Across 142 selected function trees, Claude Sonnet 4.6 produced 128 correct and informative function names versus 30 for GPT-5.4-mini, with GPT identifying the right general behavior but too imprecisely in 90 additional cases. Across more than 21,000 total functions, the two models picked the exact same name only 9.3% of the time, though this measured naming agreement rather than semantic correctness. Developers weighing LLMs for code understanding tasks can compare model results shared on daily.dev."}}]} ```