Into the Deep DNS Sea with the JSCEAL Campaign

Check Point Research (CPR) reported on the JSCEAL campaign targeting crypto app users.¹ The threat actors used malicious ads to trick victims into installing fake versions of nearly 50 of the most popular crypto trading apps. In the first half of 2025 alone, they released around 35,000 malicious ads that have been viewed at least a few million times in the European Union (EU) alone. The apps the users downloaded were, of course, masked variants of JSCEAL.

CPR identified 94 domains as indicators of compromise (IoCs). We analyzed them in great depth and uncovered these discoveries:

• 75,172 unique client IPs under 3,271 unique Autonomous System numbers (ASNs) communicated with two unique IoCs via 1,048,575 DNS requests made on 15–19 July 2025
• 56 of the 94 domains were deemed likely to turn malicious upon registration, 63–509 days prior to being reported as IoCs
• One domain IoC appeared in one typosquatting group comprising three domains (i.e., one IoC and two look-alikes) the same date the IoC was created
• 31 registrant-connected domains
• 280 email-connected domains, one was malicious
• 71 IP addresses, 70 were malicious
• 33 IP-connected domains
• 1,326 string-connected domains, three were malicious

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://research.checkpoint.com/2025/jsceal-targets-crypto-apps/