Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
54 IOCs
Cato CTRL™ Threat Research: A Deep Dive into a New JSCEAL Infostealer Campaign
Excerpt
Executive Summary JSCEAL is an information stealer that’s been targeting users of cryptocurrency applications. As reported by Check Point Research (CPR) in July 2025, JSCEAL has developed into a more advanced form. In a new campaign observed by Cato CTRL in August 2025, JSCEAL has adopted a revamped command-and-control (C2) infrastructure, enhanced anti-analysis safeguards, and an updated script engine designed for increased stealth. The campaign remains active. Cato…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →54 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | prismhills.com | High | Score 58/100 | First seen |
| Domain | velvetsforest.org | High | Score 58/100 | First seen |
| Domain | whisperhavens.com | High | Score 58/100 | First seen |
| Domain | forestsgate.com | High | Score 58/100 | First seen |
| Domain | radiantlagoons.com | High | Score 58/100 | First seen |
| Domain | download-app-windows.com | High | Score 58/100 | First seen |
| Domain | moonscanyon.org | High | Score 58/100 | First seen |
| Domain | auroratrails.link | High | Score 58/100 | First seen |
| Domain | lunasfield.net | High | Score 58/100 | First seen |
| SHA256 | 2e04eb129d72645e0167e58d404d1c5a258a97b897d61ed4ea05d2a59ab5d897 | Medium | Score 53/100 | First seen |
| Domain | lowskymeadow.com | High | Score 58/100 | First seen |
| Domain | warmtogrove.net | High | Score 58/100 | First seen |
| Domain | flowhaven.link | Medium | Score 42/100 | First seen |
| Domain | emberstolight.com | High | Score 58/100 | First seen |
| Domain | cedarwhispers.link | High | Score 58/100 | First seen |
| Domain | evergreengopath.org | High | Score 58/100 | First seen |
| Domain | starhavengo.com | High | Score 58/100 | First seen |
| Domain | rivers.com | High | Score 58/100 | First seen |
| Domain | nightfallglen.com | High | Score 58/100 | First seen |
| Domain | novaharbor.net | High | Score 58/100 | First seen |
| Domain | toautumnlake.net | High | Score 58/100 | First seen |
| Domain | veloranest.net | High | Score 58/100 | First seen |
| Domain | shadowsvale.net | High | Score 58/100 | First seen |
| Domain | lumenivory.com | High | Score 58/100 | First seen |
| SHA256 | 9615f60ea3cc1c65eb8fe6d77bb85fe6b455503193eab02310a873fccadd332e | Medium | Score 56/100 | First seen |
| Domain | silversoak.link | High | Score 58/100 | First seen |
| Domain | amberstrail.net | High | Score 58/100 | First seen |
| SHA256 | f575032cbae83be2488a59d98f7ffd5c876c8e50f11e56e5a3b071456c2ce28f | Medium | Score 53/100 | First seen |
| Domain | starsmeadows.net | High | Score 58/100 | First seen |
| Domain | coralsshore.net | High | Score 58/100 | First seen |
| Domain | sunhorizon.org | High | Score 58/100 | First seen |
| Domain | skyinwinters.org | High | Score 58/100 | First seen |
| Domain | opencrest.name | High | Score 58/100 | First seen |
| Domain | leafmollytrail.com | High | Score 58/100 | First seen |
| Domain | goldentrail.name | High | Score 58/100 | First seen |
| Domain | amberfielder.com | High | Score 58/100 | First seen |
| Domain | mapleonhaven.net | High | Score 58/100 | First seen |
| Domain | maplehaven.fyi | High | Score 58/100 | First seen |
| Domain | lighttrail.name | High | Score 58/100 | First seen |
| Domain | freshstartwalk.org | High | Score 58/100 | First seen |
| Domain | ironscove.net | High | Score 58/100 | First seen |
| SHA256 | 72af070240c149cda4ad6b6ebb581af4285402d1e2d1ae77dbdb8db41cce3828 | Medium | Score 53/100 | First seen |
| Domain | wildflowerpath.org | High | Score 58/100 | First seen |
| Domain | everlantern.net | High | Score 58/100 | First seen |
| Domain | stillswaters.link | High | Score 58/100 | First seen |
| Domain | cedarspath.com | High | Score 58/100 | First seen |
| Domain | northhollow.net | High | Score 58/100 | First seen |
| Domain | calmtobridge.com | High | Score 58/100 | First seen |
| Domain | ravencliff.org | High | Score 58/100 | First seen |
| Domain | evercircle.org | High | Score 58/100 | First seen |
| Domain | lunarapoint.org | High | Score 58/100 | First seen |
| URL | https://goldensecho.link | High | Score 58/100 | First seen |
| Domain | nordexahub.name | High | Score 58/100 | First seen |
| Domain | aurevospace.org | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…