Cato CTRL™ Threat Research: A Deep Dive into a New JSCEAL Infostealer Campaign

This report describes the August 2025 evolution of the JSCEAL infostealer: operators replaced multi-word hyphenated C2 domains with single-word domains across varied TLDs, standardized subdomains (.faro and .api), and added strict UA-based access control and PDF-gated, multi-stage payload delivery. The PowerShell loader was refactored to use COM objects for persistence and support multiple payload formats, build.zip contents were changed, and numerous domain and hash IoCs are provided; Cato’s SASE/MDR protections are shown blocking the activity before payload execution.