Cookies come out of each Chromium profile's user-data directory, one profile at a time [6]. They go back into a browser the malware starts on the same host, and the automation is written to avoid looking like a bot while it walks Google's own authentication flow [9]. If Google asks for a password, the malware tries every credential it already lifted from that machine until one is accepted, and the run ends with a fresh, valid OAuth token [10]. Check Point describes the same behaviour as active session replay to gain unauthorized access to a victim's Google account [11].
Check Point's recovered flow describes a password prompt and credential stuffing, with no second factor challenged [10]. The published evidence supports authentication bypass by session replay [11], and the artifact left behind is a token [10]. Whether MFA was enforced on the targeted accounts, and beaten, is not something the evidence establishes either way. Credential rotation that does not also revoke sessions and third-party grants leaves that access standing.
The naming needs care. JSCeal, WEEVILPROXY and MeadowLocust are one thing under three vendor labels [1], and Confiant's SourTrade overlaps a JSCeal campaign Bitdefender wrote up in September 2025 [17]. Four labels sit on one cluster [19], the work of one operation rather than four crews independently arriving at cookie theft. Dated reporting places the same activity in 2024, 2025 and 2026 [20]. SourTrade's contribution is on the delivery side: according to Confiant, the landing page hands the browser assembly instructions, pulls a clean legitimate file from separate infrastructure, and has the browser build the payload in memory, so no finished malware ever exists on the network [18].
The service-specific handlers are where money moves. A configuration function exposes separate overrides for Binance, Bybit and Ledger, plus generic handlers for replacing HTML, blocking hosts and clearing cookies [8]. In practice that means the Binance login QR code swapped, a fake security challenge injected on Bybit, and Ledger's own scripts replaced with attacker-controlled content [7].
The analysis cost is lopsided. Two obfuscation layers, both assembled from existing open-source components, were cheap to produce and expensive to unwind, per the Security Affairs account of the report [14]. The answer was a purpose-built pipeline on top of the open-source View8 decompiler, which recovered readable code from 23 of 23 samples, a 100 percent hit rate [12][21]. Two things in this chain remain cheap to hunt for on a host: an attacker-generated certificate in the local trust store [5], and a Node.js runtime unzipped by PowerShell into a user directory [4]. Both land before the token does.
