Malware
WEEVILPROXY
Also known as: JSCEAL
WEEVILPROXY is a sophisticated and featureful stealer which has a payload primarily written in NodeJS. The developer has put in concerted effort to develop the malware’s breadth of capabilities, including novel techniques not observed in any prior malware campaigns - to our knowledge. These new TTPs include methods to modify Windows Setup and Windows Recovery to enable long-term persistence, as well as methods to patch browser extensions ‘on the fly’.
Indicators of Compromise 5
MITRE ATT&CK TTPs 12
T1003 T1003.001 T1005 T1059.001 T1059.007 T1070.004 T1071.001 T1090 T1105 T1204.002 T1555 T1555.003
OS Credential Dumping
Credential Access
LSASS Memory
Credential Access
Data from Local System
Collection
PowerShell
Execution
JavaScript
Execution
File Deletion
Defense Evasion
Web Protocols
Command And Control
Proxy
Command And Control
Ingress Tool Transfer
Command And Control
Malicious File
Execution
Credentials from Password Stores
Credential Access
Credentials from Web Browsers
Credential Access
Source Articles
JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies
JSCeal is a compiled V8 JavaScript malware designed to steal browser credentials, cookies, and OAuth tokens, enabling attackers to bypass Google authentication via session replay attacks. It is distributed through malvertising campaigns, particularly the SourTrade operation, which impersonates legitimate cryptocurrency trading platforms like TradingView, Solana, and Luno. The malware uses heavy obfuscation techniques and in-memory assembly to avoid detection, and includes modules for keystroke logging, screenshot capture, and traffic interception via a local proxy targeting financial and cryptocurrency services.
hacker-news ·4d ago
Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
A malvertising campaign dubbed SourTrade has been active since late 2024, targeting retail traders and cryptocurrency investors across 12 countries by impersonating legitimate services like TradingView, Solana, and Luno. The attack uses a legitimate Bun runtime to dynamically assemble Windows executables within the victim's browser, leveraging ServiceWorker and SharedWorker to build malware pieces in memory. This technique avoids delivering a complete malicious binary over the network, instead using Base64-encoded components and AES-CTR-generated streams to create unique per-session payloads, evading hash-based detection.
hacker-news ·1mo ago