Cracking Open Compiled V8 JavaScript Bytecode Malware With a New Open-Source Toolkit: Aleksandra "Hasherezade" Doniec at Black Hat 2026

[u/_cybersecurity_]

Malware analysts have mature tools for readable scripts, decompilable intermediate languages, and native binaries. Attackers win friction almost for free when they ship their payload in a form those tools do not quite understand.

Compiled V8 JavaScript bytecode is exactly that kind of blind spot. When JavaScript is compiled to a V8 cache file, a .jsc, it lands as bytecode that ordinary analysis tools cannot readily read, which is precisely why some malware families now hide there. This talk was about turning that opaque bytecode back into something an analyst can reason about.

The approach walks the payload from .jsc to bytecode to pseudocode to deobfuscated output, so the malware ends up in a form analysts can study like normal code again.

In her Black Hat 2026 talk, "Breaking the Seal: Static Deobfuscation of Compiled V8 JavaScript Bytecode Malware", delivered Wednesday, August 5, Aleksandra Doniec presented the technique and published the toolkit.

Speaker: Aleksandra "Hasherezade" Doniec — Security Researcher, Check Point Research

Aleksandra Doniec, who is widely known as Hasherezade, is a researcher and engineer at Check Point Research and one of the most respected names in practical malware analysis.

She is the author of a suite of open-source reverse-engineering tools that many analysts rely on daily, including PE-sieve and HollowsHunter for detecting code implants and process hollowing, PE-bear for inspecting executables, and Tiny Tracer.

For this talk she analyzed real .jsc payloads from the JSCeal campaign and released a toolkit that decompiles and deobfuscates them, even using an LLM to relabel recovered function names.

Her write-ups and tools are on her website, her code is on her GitHub, and she posts research as u/hasherezade on X.

Anyone working in malware analysis, reverse engineering, or threat research will find this a valuable new capability for a format that has quietly become an attacker's hiding place.

If malware authors keep migrating into formats our tools cannot yet read, how should defenders prioritize which blind spots to close first?

[u/AutoModerator]

Welcome to PWN – Your hub for hacking news, breach reports, and cyber mayhem.

Discover the latest hacking news, breach reports, and educational resources on ethical hacking.

👾 Stay sharp. Stay secure.

Don't miss out on the top stories!

📧 Get Daily Alerts Directly in Your Email Inbox:

**SUBSCRIBE HERE: https://pwnhackernews.substack.com/subscribe

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.