Jewelbug Combines Government Espionage and Crypto Fraud in XG-Web
China-linked threat actor Jewelbug has used its XG-Web platform to conduct espionage against government and military targets while operating a cryptocurrency fraud business aimed at Chinese-speaking users. Broadcom’s Symantec and Carbon Black Threat Hunter Team said the group’s browser-centric remote-access and information-stealing framework administered both missions from a single control panel.
The investigation found more than one million implant check-in rows, over 580,000 stolen browser cookies, several thousand captured credentials and at least 2,300 exfiltrated email bodies. Runtime logs also recorded about 1.1 million geolocation events across roughly 4,300 distinct source IP addresses.
A browser extension at the centre of XG-Web
XG-Web is built as a React panel over a Node.js backend and a MySQL database. Jewelbug developers described it as a penetration-testing platform, but Symantec said it coordinated implants spanning browsers, Windows endpoints, Linux servers and network devices. The group also used scheduled checks of its command-and-control infrastructure against VirusTotal every 12 hours, enabling rapid infrastructure rotation.
Its primary browser implant is a malicious extension called PDF Viewer, compatible with Google Chrome and Mozilla Firefox. It requests permissions to access cookies, debugger functions and native messaging, execute scripts, intercept web requests and monitor downloads. Those permissions enable remote browser interaction and collection of login-form data, cookies, history, bookmarks, screenshots, clipboard contents and web traffic.
The extension can also alter copied cryptocurrency wallet addresses, although investigators said no replacement rules were triggered during the observed campaign period. To move beyond the browser sandbox, it communicated with a Windows helper registered as a native-messaging host under the misleading name com.microsoft.runedge. That helper executed operator commands through the Windows command interpreter and returned results to the XG-Web panel.
Webmail watering holes and infrastructure access
In the largest espionage operation described by Symantec, Jewelbug compromised a web hosting provider and injected JavaScript into a shared webmail deployment used by ministries tied to a Middle Eastern government. The watering-hole activity affected 15 government webmail tenants. Malicious code ran on login pages and mailbox views, exfiltrating cookies through a WebSocket connection and evaluating whether a victim belonged to selected government domains, had not been compromised already and was using Windows.
Eligible victims received a fake Adobe Flash update prompt. The next-stage executable, Antino, was delivered from a Jewelbug-managed domain and installed both malware and the PDF Viewer extension. Registry changes ensured the extension would launch with the browser. Antino is also delivered through malicious HTA downloaders themed around current geopolitical events and bogus Adobe Flash or Adobe installer files; it uses the Microsoft Graph API for command and control.
The group’s Linux and router implant, ClientKing, supports interactive shell access, SOCKS pivoting and in-memory kernel-module loading through five command-and-control channels, including DNS tunnelling. Related builds were configured to beacon through the internal corporate proxy of a major US aerospace and industrial manufacturer. The mix of browser, endpoint and network-device tooling expands the operational consequences of credential theft, as illustrated by credential and malware chain risks in the context of wider credential and malware chains.
Fraud infrastructure operated alongside espionage
Jewelbug’s financial operation used artificial-intelligence-generated pages impersonating OKX and Binance, more than 40 content-management servers and click-fraud bots to influence search rankings. Victims landing on the false exchange pages could download a trojanized desktop client or the PDF Viewer extension, exposing sensitive data.
For businesses, the findings make browser extensions, webmail integrity and software-download controls central security priorities. Monitoring unusual extension permissions and native-messaging registrations, protecting shared webmail infrastructure and validating exchange-related downloads can reduce exposure to the routes Jewelbug used.