Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

JSCeal malware activity

Malware Activity
First reported
Last updated
Happening score
H score 29
1 unique sources, 1 articles

Summary

Hide ▲

JSCeal is a compiled V8 JavaScript malware that now stands out for credential harvesting, session replay, and traffic interception against browser data. The malware can extract cookies, passwords, and OAuth tokens, then use stolen session data to bypass authentication and access victim accounts. It also adds keystroke logging, screenshots, and proxy-based request modification, increasing both theft and surveillance risk.

Related Happenings

SourTrade malvertising campaign impersonating trading and cryptocurrency brands

Campaign
H score34 First: 07.09.2026 10:53 Last: 07.09.2026 10:53 Sources 1

How related: The campaign is assessed to be active since late 2024, targeting retail traders and cryptocurrency investors across 12 countries in 25 languages, primarily in Asia Pacific and Latin America.

About this happening: The SourTrade malvertising campaign remains active, using lookalike portals and malicious JavaScript to target retail traders and cryptocurrency investors across *...

Open Happening

ClickFix AmnesiaStealer distribution campaign targeting mac users

Campaign
H score22 First: 14.08.2026 13:45 Last: 14.08.2026 13:45 Sources 1

About this happening: A ClickFix campaign is distributing AmnesiaStealer to macOS users through a counterfeit GitHub "Download for macOS" page and a copy-and-paste command that launches...

Latest development: 16.08.2026 18:07

Jamf described AmnesiaStealer's stream_module and remote_stream commands, which copy a victim's Chromium profile into a hidden headless browser and open WebSocket and Chrome DevTools Protocol channels through webSocketDebuggerUrl. The operator can issue navigation and mouse commands, receive live screencasts, and export or import cookies to operate online portals inside the victim's authenticated sessions on Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium.

Open Happening

AmnesiaStealer macOS infostealer distributed via ClickFix

Malware Activity
H score16 First: 14.08.2026 13:45 Last: 14.08.2026 13:45 Sources 1

About this happening: AmnesiaStealer is a Rust-based macOS infostealer spread through a counterfeit GitHub "Download for macOS" page and ClickFix-style lure. It steals Keychain, b...

Open Happening

Fake Xeno Executor Java RAT and infostealer malware

Malware Activity
H score30 First: 03.08.2026 22:25 Last: 03.08.2026 22:25 Sources 1

About this happening: Fake Xeno Executor installers are infecting Roblox players through gaming forums, Discord communities, and compromised or impersonated accounts, with victims runni...

Open Happening

Rokarolla Android banking trojan activity

Malware Activity
H score26 First: 16.06.2026 16:15 Last: 16.06.2026 16:15 Sources 1

About this happening: The Rokarolla Android banking trojan is expanding phone-level control on infected devices, letting attackers steal credentials, intercept authentication codes, and hide fr...

Open Happening

Timeline

  1. 07.09.2026 10:53 2 articles · 3h ago

    JSCeal malware activity

    Initial Disclosure

    JSCeal was first documented in July 2025 as a compiled V8 JavaScript malware family. The initial reporting tied it to fake cryptocurrency trading sites and browser-focused credential theft.

    Show sources
    Open in new tab