Breaking the Seal Static Deobfuscation of JSCeal's Compiled ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://research.checkpoint.com/2026/breaking-the-seal-static-deobfuscation-of-jsceals-compiled-v8-bytecode
• Blog Title: Breaking the Seal: Static Deobfuscation of JSCeal's Compiled V8 Bytecode
• Suggested Section: Reversing -> Reversing Tools & Basic Methods -> Static Deobfuscation of Node.js/V8 Cached Bytecode

🎯 Content Summary

Overview

Check Point Research presents a fully static pipeline for decompiling and deobfuscating JSCeal, also tracked as WEEVILPROXY or MeadowLocust. JSCeal is a cryptocurrency-focused information stealer with broader browser and credential theft, Telegram session theft, keylogging, screenshot capture, hidden PowerShell execution, process spawning, and HTTPS interception capabilities. Instead of shipping JavaScript source, the attackers obfuscate it with

[carlospolop]

🔗 Additional Context

Original Blog Post: https://research.checkpoint.com/2026/breaking-the-seal-static-deobfuscation-of-jsceals-compiled-v8-bytecode

Content Categories: Based on the analysis, this content was categorized under "Reversing -> Reversing Tools & Basic Methods -> Static Deobfuscation of Node.js/V8 Cached Bytecode".

Repository Maintenance:

• MD Files Formatting: 999 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0