JSCeal proxy module deletes browser cookies via local HTTPS interception

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•1

This rule detects suspicious activity associated with JSCeal proxy handlers. It identifies Node.js or Electron processes running from non-standard, user-writable directories (such as AppData, ProgramData, or Temp folders) that actively delete or modify browser cookie files within standard web browser profile paths, often indicative of session hijacking or data tampering.