JSCEAL MALWARE CAN BYPASS GOOGLE AUTHENTICATION USING STOLEN SESSION COOKIES

Summary from the TLDR InfoSec newsletter

JSCeal is distributed via fake TradingView installers advertised on Facebook and Google. It harvests browser passwords, cookies, OAuth tokens, and profile information from Chromium browsers. Stolen Google cookies can restore authenticated sessions and bypass login screens. The malware also logs keystrokes, takes screenshots, and sets up a local proxy that manipulates traffic for Binance, Bybit, Ledger, and various other services.