The malicious payloads are heavily obfuscated using javascript-obfuscator, employing a layered approach to evade analysis. Key protection mechanisms observed by Check Point Research include:

• RC4-protected strings to conceal data
• Control-flow flattening to disrupt code analysis
• Proxy functions to obscure function calls
• Operation wrappers to further complicate reverse engineering

JSCeal's capabilities extend beyond simple credential theft, encompassing broader surveillance and traffic-interception functions. The malware is compiled for the V8 JavaScript engine, a departure from typical script-based threats, which allows it to operate with greater stealth and complexity.

Source: The Hacker News

Given the malware's reliance on stolen session cookies rather than traditional credential phishing, how is your organization monitoring for suspicious session anomalies in Google Workspace?