JSCeal Malware Bypasses Google Auth with Stolen Cookies
JSCeal is compiled V8 JavaScript malware with credential harvesting and traffic interception. It bypasses Google Authentication using stolen session cookies.
Morgan "airgap" ReyesJSCeal is a newly documented credential-harvesting malware. Researchers report it can bypass Google Authentication by replaying stolen session cookies. Published findings: 2026-09-07, The Hacker News.
Attribution, distribution method, and targeted sectors: unconfirmed at time of writing.
Technical profile
JSCeal is compiled V8 JavaScript bytecode, the .jsc format used by Chrome and Node.js internally. Precompiled bytecode is harder to decompile and analyze than source JavaScript. Security tooling that expects plain script files may not flag it. Capabilities confirmed by researcher report: credential harvesting, network traffic interception, and surveillance.
The session cookie bypass
The Google Authentication bypass works via session cookie replay. Successful authentication, including any MFA step, produces a session cookie. If JSCeal exfiltrates that cookie before the session expires, the attacker holds a valid active session. Google’s authentication infrastructure sees an already-authenticated client. MFA is already past at that point.
Session cookie theft is not a Google flaw. It is the same technique behind the bulk of browser-targeted infostealer campaigns. Any service that issues session cookies after authentication is susceptible. Phishing-resistant credentials (passkeys, hardware security keys) reduce attack surface because they narrow the window where cookie theft is possible, but they do not prevent exfiltration of cookies once issued.
What is confirmed
- JSCeal is real and analyzed. Confidence: high.
- Capabilities (credential theft, traffic interception, surveillance): confirmed by researchers.
- Google Authentication session cookie bypass: confirmed by researchers.
- CVE assignment: none as of 2026-09-07T10:00Z.
- CISA advisory or KEV addition: none confirmed.
- Distribution vector: unconfirmed.
- Affected sector or geographic targeting: unconfirmed.
For related credential-theft activity, see PaperCut Attackers Steal Credentials From Schools and TerminalFix: New ClickFix Drops Reverse-Tunnel Backdoor.
Found this useful? Share it.
