#ParsedReport #CompletenessLow
31-08-2026

Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode

https://research.checkpoint.com/2026/breaking-the-seal-static-deobfuscation-of-jsceals-compiled-v8-bytecode/

Report completeness: Low

Threats:
Jsceal
Mitm_technique
Weevilproxy

Victims:
Cryptocurrency services, Banking services, Browser users, Telegram users

Industry:
Financial

TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1005, T1010, T1027, T1027.013, T1027.015, T1036, T1056.001, T1059.001, T1059.007, T1105, have more...

IOCs:
File: 19
Path: 1
Hash: 72

Soft:
macOS, Node.js, Linux, Anthropic, OpenAI, Ollama, Claude, GPT-5, Windows certificate, zoom, have more...

Wallets:
bybit

Crypto:
binance, kucoin

Algorithms:
base64, rc4, zip, md5, aes, hmac, aes-256-cbc

Functions:
r1, r0, func_KV_0x18c3e8c9a1c1, func_J_0x16abcdb59891, global_n2, global_d7e, global_M7e, func_unknown_0x93e23cef9f9, thunk, func_unknown_0x217bb6195779, have more...

Win API:
writeFile

Languages:
powershell, python, javascript

Links:
https://github.com/javascript-obfuscator/javascript-obfuscator
have more...
https://github.com/hasherezade/jsc\_deobfuscator