Malware

WEEVILPROXY

Also known as: JSCEAL

WEEVILPROXY is a sophisticated and featureful stealer which has a payload primarily written in NodeJS. The developer has put in concerted effort to develop the malware’s breadth of capabilities, including novel techniques not observed in any prior malware campaigns - to our knowledge. These new TTPs include methods to modify Windows Setup and Windows Recovery to enable long-term persistence, as well as methods to patch browser extensions ‘on the fly’.

Indicators of Compromise 2

Domain purelogicbox[.]org GitHub Repo https://github.com/jimmywarting/StreamSaver.js

MITRE ATT&CK TTPs 5

T1005
Data from Local System
Collection
 T1059.007
JavaScript
Execution
 T1071.001
Web Protocols
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1204.002
Malicious File
Execution

Source Articles

Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
A malvertising campaign dubbed SourTrade has been active since late 2024, targeting retail traders and cryptocurrency investors across 12 countries by impersonating legitimate services like TradingView, Solana, and Luno. The attack uses a legitimate Bun runtime to dynamically assemble Windows executables within the victim's browser, leveraging ServiceWorker and SharedWorker to build malware pieces in memory. This technique avoids delivering a complete malicious binary over the network, instead using Base64-encoded components and AES-CTR-generated streams to create unique per-session payloads, evading hash-based detection.
hacker-news ·2d ago