Google: JSCeal Malware Bypasses Google Auth with Stolen Session Cookies

New Malware JSCeal Exploits Google Session Cookies to Bypass MFA

Check Point Research has uncovered JSCeal, a sophisticated malware strain targeting Windows systems to steal credentials, conduct surveillance, and bypass multi-factor authentication (MFA) on Google accounts by hijacking session cookies.

The malware leverages compiled V8 JavaScript the same engine powering Chrome and Node.js to evade traditional signature-based detection. Its multi-layer obfuscation includes RC4-encrypted strings, control-flow flattening, and proxy functions, making analysis difficult. These techniques obscure the malware’s behavior until runtime, complicating static detection efforts.

Once deployed, JSCeal scans for active Google session cookies stored in browsers. These cookies contain authentication tokens that validate a completed login, including any MFA challenges. By reusing these tokens, attackers gain unauthorized access to Google services without needing passwords or secondary authentication, as the system treats the stolen session as legitimate.

Beyond Google accounts, JSCeal monitors user activity, harvests credentials from other services, and intercepts network traffic, expanding its impact beyond the initial compromise. The malware’s ability to bypass MFA highlights a growing trend: as organizations strengthen authentication controls, attackers increasingly target post-authentication session tokens rather than credentials alone.

To mitigate risks, security teams are advised to detect obfuscated JavaScript payloads, monitor unusual cookie access patterns, and enforce short session timeouts for Google Workspace accounts. Continuous access evaluation which revalidates sessions based on location, device, and behavior can further limit the effectiveness of stolen cookies by triggering re-authentication when anomalies are detected.

JSCeal underscores the need for session-level protections alongside traditional authentication measures, as credential hardening alone is insufficient against modern malware tactics.

Source: https://dailysecurityreview.com/cyber-security/jsceal-malware-bypasses-google-auth-with-stolen-session-cookies/

Google TPRM report: https://www.rankiteo.com/company/googlecloudsecurity

"id": "goo1788891902",
"linkid": "googlecloudsecurity",
"type": "Cyber Attack",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'type': 'Organization'}],
 'attack_vector': 'Session cookie hijacking',
 'data_breach': {'personally_identifiable_information': 'Potential (session '
                                                        'tokens, credentials)',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Credentials',
                                              'Session cookies',
                                              'Network traffic']},
 'description': 'Check Point Research has uncovered JSCeal, a sophisticated '
                'malware strain targeting Windows systems to steal '
                'credentials, conduct surveillance, and bypass multi-factor '
                'authentication (MFA) on Google accounts by hijacking session '
                'cookies. The malware leverages compiled V8 JavaScript to '
                'evade traditional signature-based detection and uses '
                'multi-layer obfuscation techniques to obscure its behavior. '
                'JSCeal scans for active Google session cookies, allowing '
                'attackers to bypass MFA by reusing authentication tokens. It '
                'also monitors user activity, harvests credentials from other '
                'services, and intercepts network traffic.',
 'impact': {'data_compromised': 'Credentials, session cookies, network traffic',
            'identity_theft_risk': 'High',
            'operational_impact': 'Unauthorized access to Google services, '
                                  'surveillance, credential theft',
            'systems_affected': 'Windows systems'},
 'lessons_learned': 'JSCeal underscores the need for session-level protections '
                    'alongside traditional authentication measures, as '
                    'credential hardening alone is insufficient against modern '
                    'malware tactics.',
 'post_incident_analysis': {'corrective_actions': 'Session-level protections, '
                                                  'enhanced monitoring, '
                                                  'session timeout policies, '
                                                  'continuous access '
                                                  'evaluation',
                            'root_causes': 'Exploitation of Google session '
                                           'cookies to bypass MFA, use of '
                                           'obfuscated JavaScript to evade '
                                           'detection'},
 'recommendations': ['Detect obfuscated JavaScript payloads',
                     'Monitor unusual cookie access patterns',
                     'Enforce short session timeouts for Google Workspace '
                     'accounts',
                     'Implement continuous access evaluation to revalidate '
                     'sessions based on location, device, and behavior'],
 'references': [{'source': 'Check Point Research'}],
 'response': {'enhanced_monitoring': 'Recommended (detect obfuscated '
                                     'JavaScript payloads, monitor unusual '
                                     'cookie access patterns)'},
 'title': 'New Malware JSCeal Exploits Google Session Cookies to Bypass MFA',
 'type': 'Malware',
 'vulnerability_exploited': 'Google session cookies (authentication tokens)'}