JSCeal V8 Bytecode Cryptocurrency Stealer: Compiled Node.js Infostealer Evading Static Analysis — OTX Pulse Detection Pack

---
title: Node.js Execution of Compiled V8 Bytecode Payload (JSCeal)
id: 9f3a1c7e-2b4d-4e8a-9c1f-jsceal0001
status: experimental
description: Detects node.exe or bundled Node runtimes executing .jsc compiled V8 bytecode files, the delivery format used by the JSCeal infostealer. Legitimate use of .jsc on end-user workstations is rare outside packaged commercial applications.
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\node.exe'
    selection_cli:
        CommandLine|contains:
            - '.jsc'
    filter_known_paths:
        Image|startswith:
            - 'C:\Program Files\nodejs\'
            - 'C:\Program Files (x86)\nodejs\'
    condition: selection_img and selection_cli and not filter_known_paths
falsepositives:
    - Packaged commercial applications bundling Node with compiled bytecode
    - Developer environments
level: high
tags:
    - attack.execution
    - attack.t1059.007
date: 2026/08/31
---
title: Rogue System Proxy Configuration via Registry (MITM Injection)
id: 9f3a1c7e-2b4d-4e8a-9c1f-jsceal0002
status: experimental
description: Detects modification of Internet Settings proxy registry values (ProxyServer, ProxyOverride, AutoConfigURL) by non-browser processes, consistent with JSCeal's MITM proxy injection used to intercept browser traffic and steal sessions in transit.
author: Security Arsenal Threat Intelligence
logsource:
    category: registry_set
    product: windows
detection:
    selection_key:
        TargetObject|contains:
            - '\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer'
            - '\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL'
            - '\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride'
    filter_legit:
        Image|endswith:
            - '\svchost.exe'
            - '\explorer.exe'
            - '\msiexec.exe'
    condition: selection_key and not filter_legit
falsepositives:
    - Enterprise GPO proxy deployment tooling
    - VPN and secure gateway clients
level: medium
tags:
    - attack.collection
    - attack.t1557
date: 2026/08/31
---
title: Browser Credential Store Access by Node.js Process (JSCeal Theft)
id: 9f3a1c7e-2b4d-4e8a-9c1f-jsceal0003
status: experimental
description: Detects node.exe accessing Chromium browser Login Data, Cookies, or Web Data files or cryptocurrency wallet paths — the collection behavior of browser/credential stealers such as JSCeal. Browsers do not use node.exe to read their own stores.
author: Security Arsenal Threat Intelligence
logsource:
    category: file_access
    product: windows
detection:
    selection_img:
        Image|endswith: '\node.exe'
    selection_target:
        TargetObject|contains:
            - '\Google\Chrome\User Data\'
            - '\Microsoft\Edge\User Data\'
            - '\BraveSoftware\Brave-Browser\User Data\'
            - '\Opera Software\Opera Stable\'
            - '\Login Data'
            - '\Cookies'
            - '\Web Data'
            - '\wallet.dat'
            - '\Exodus\'
            - '\Electrum\'
            - '\atomic\Local Storage\'
    condition: selection_img and selection_target
falsepositives:
    - Legitimate Electron-based applications with embedded browser profiles
    - Browser sync or backup utilities using Node runtimes
level: high
tags:
    - attack.credential_access
    - attack.t1555.003
    - attack.t1539
date: 2026/08/31

let JscealHashes = dynamic([
    "03f4e47b9c2283c32bb8f8f042ce6e41",
    "0d1fce0cb2b9dec26a10f0822aeffb19",
    "581e2e2265d0c1509b3799c5a9039374",
    "91038aebe528a065c3e995a418db6826",
    "de10c6b3dc4619f59bc9c80a0aa15e6a",
    "e27ae65977287bdfb7b0e15fd3603f85"]);
let Lookback = 14d;
let ProcessHits = DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName =~ "node.exe"
    | where ProcessCommandLine has_any (".jsc", "bytenode", "v8-compile-cache")
        or ProcessCommandLine has_any ("Login Data", "Cookies", "wallet", "Local Storage")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName;
let HashHits = DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where MD5 in (JscealHashes) or SHA256 in (JscealHashes)
    | project TimeGenerated, DeviceName, FolderPath, FileName, MD5, InitiatingProcessFileName;
let ProxyNetHits = DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName =~ "node.exe"
    | where not(RemoteUrl has_any ("npmjs.org", "nodejs.org", "microsoft.com", "github.com"))
    | where RemotePort in (80, 443, 8080, 8443)
    | summarize Connections=count(), RemoteEndpoints=make_set(RemoteIP, 10), RemoteUrls=make_set(RemoteUrl, 10)
        by DeviceName, InitiatingProcessFolderPath, bin(TimeGenerated, 1h)
    | where Connections > 5;
union ProcessHits, HashHits, ProxyNetHits
| sort by TimeGenerated desc

# JSCeal V8 Bytecode Stealer — Host Hunt Script
# Run elevated. Outputs findings to console and C:\Temp\JscealHunt_<hostname>.txt

$hashes = @(
    "03f4e47b9c2283c32bb8f8f042ce6e41",
    "0d1fce0cb2b9dec26a10f0822aeffb19",
    "581e2e2265d0c1509b3799c5a9039374",
    "91038aebe528a065c3e995a418db6826",
    "de10c6b3dc4619f59bc9c80a0aa15e6a",
    "e27ae65977287bdfb7b0e15fd3603f85"
)

$findings = @()

Write-Host "[*] Checking running Node.js processes..." -ForegroundColor Cyan
Get-CimInstance Win32_Process -Filter "Name='node.exe'" | ForEach-Object {
    if ($_.CommandLine -match '\.jsc|Login Data|Cookies|wallet|bytenode') {
        $findings += "[ALERT] Suspicious node.exe PID $($_.ProcessId): $($_.CommandLine)"
    } else {
        $findings += "[INFO] node.exe running PID $($_.ProcessId) — review: $($_.CommandLine)"
    }
}

Write-Host "[*] Checking for rogue proxy configuration (MITM indicator)..." -ForegroundColor Cyan
foreach ($hive in @("HKCU:","HKU:")) {
    Get-ChildItem "$hive" -ErrorAction SilentlyContinue | Out-Null
}
$proxyPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
$proxy = Get-ItemProperty -Path $proxyPath -ErrorAction SilentlyContinue
if ($proxy.ProxyEnable -eq 1 -and $proxy.ProxyServer) {
    $findings += "[ALERT] Manual proxy enabled: ProxyServer=$($proxy.ProxyServer) — verify legitimacy"
}
if ($proxy.AutoConfigURL) {
    $findings += "[ALERT] PAC file configured: $($proxy.AutoConfigURL) — verify legitimacy"
}

Write-Host "[*] Checking persistence locations for Node.js invocation..." -ForegroundColor Cyan
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($key in $runKeys) {
    Get-ItemProperty -Path $key -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty | ForEach-Object {
        $val = (Get-ItemProperty -Path $key -Name $_.Name -ErrorAction SilentlyContinue).($_.Name)
        if ($val -match 'node\.exe|\.jsc') {
            $findings += "[ALERT] Run key persistence ($key): $($_.Name) = $val"
        }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    ($_.Actions | Out-String) -match 'node\.exe|\.jsc'
} | ForEach-Object {
    $findings += "[ALERT] Scheduled task invoking Node: $($_.TaskName) — $($_.Actions.Execute) $($_.Actions.Arguments)"
}

Write-Host "[*] Sweeping user profiles for known JSCeal sample hashes..." -ForegroundColor Cyan
$searchPaths = @("$env:USERPROFILE\Downloads","$env:USERPROFILE\AppData","$env:TEMP")
foreach ($path in $searchPaths) {
    Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue |
        Where-Object { $_.Length -lt 50MB } |
        ForEach-Object {
            $md5 = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($hashes -contains $md5.ToLower()) {
                $findings += "[CRITICAL] Known JSCeal sample found: $($_.FullName) (MD5: $md5)"
            }
        }
}

Write-Host "[*] Checking for .jsc bytecode files outside Program Files..." -ForegroundColor Cyan
Get-ChildItem -Path "$env:USERPROFILE" -Recurse -Filter "*.jsc" -ErrorAction SilentlyContinue | ForEach-Object {
    $findings += "[ALERT] Compiled V8 bytecode file in user profile: $($_.FullName)"
}

$out = "C:\Temp\JscealHunt_$env:COMPUTERNAME.txt"
New-Item -Path "C:\Temp" -ItemType Directory -Force -ErrorAction SilentlyContinue | Out-Null
if ($findings.Count -eq 0) { $findings = @("[CLEAN] No JSCeal indicators found on $env:COMPUTERNAME") }
$findings | Tee-Object -FilePath $out
Write-Host "[*] Hunt complete. Results written to $out" -ForegroundColor Green