A China-based hackers-for-hire group tracked as Jewelbug (also known as Earth Alux, REF7707 and CL-STA-0049) compromised the shared webmail infrastructure serving at least 15 government tenants in a single Middle Eastern country, using a single planted script to turn official login pages into a watering hole for espionage. The finding comes from a months-long investigation by Broadcom's Symantec Threat Hunter Team, published August 13, 2026 and picked up across the security press the same day. Symantec's own writeup puts the recovered victim data at more than one million implant check-ins and more than 580,000 stolen browser cookies in under three months of active operations. The same team, on the same infrastructure, was simultaneously running a for-profit cryptocurrency fraud business from the identical control panel.
What Happened
Symantec describes two operations that most analysts would expect to find in different threat actors entirely: state-aligned espionage against government ministries and militaries, and volume cryptocurrency fraud aimed at ordinary internet users. Both were administered from one custom panel called XG-Web, with operators switching between missions, in Dark Reading's phrasing, as easily as jumping between browser tabs.
The espionage side hit government, military and telecommunications organizations. Sources describe the geographic spread slightly differently: Symantec and OffSeq place victims across the Middle East, Southeast Asia and South Asia, while Dark Reading and SC Media summarize it more broadly as Asia and the Middle East. SC Media adds that a major U.S. industrial manufacturer was among the victims; Symantec's own account is more specific, stating that one set of implants was configured to use the internal proxy of a major U.S. aerospace and industrial manufacturer, which is a somewhat narrower claim than outright compromise.
The headline operation was the webmail breach. BleepingComputer reports 15 government tenants; Symantec, HEAL Security and OffSeq all say "more than 15." Treat 15 as the floor.
Attribution is consistent but not absolute. Every source describes Jewelbug as China-based and mercenary. Symantec goes further than the outlets, saying at least one operator is tied to a registered company in Hunan Province and that researchers identified the sole legal representative by name from government-issued identity documents belonging to the operators. SC Media frames the motive as either operating on behalf of a Chinese state agency or acting independently with intent to sell stolen material to government contacts. Dark Reading's Symantec source, principal intelligence analyst Dick O'Brien, argues the fraud scale rules out simple moonlighting: "They aren't just making a little extra money by moonlighting."
What Was Taken
The victim database recovered by Symantec is the clearest measure of impact, and the figures differ by source in ways worth stating plainly:
- Browser cookies: more than 580,000, per Symantec, HEAL Security and OffSeq. SC Media, summarizing Dark Reading, says only "hundreds of thousands."
- Implant check-ins: more than one million in under three months (Symantec, HEAL Security, OffSeq).
- Credentials: "thousands of login credentials" (SC Media), "thousands of captured credentials" (HEAL Security).
- Email bodies: more than 2,300 stolen, a figure reported by HEAL Security citing Symantec's report as shared with Cyber Security News. This one appears in a single OTHER-tier source and should be attributed rather than treated as confirmed.
Beyond bulk counts, the PDF Viewer browser extension was built to take essentially everything a browser holds: cookies, session tokens, browsing history, bookmarks, screenshots, clipboard contents and traffic, per Dark Reading and HEAL Security. For government mailbox users, the practical exposure is the correspondence itself plus the session access needed to keep reading it.
Why It Matters
Stolen session cookies bypass multi-factor authentication. That is the core defensive problem here: an organization can have MFA correctly deployed across its webmail estate and still lose mailboxes wholesale, because the attacker replays a valid authenticated session rather than logging in. HEAL Security makes this point directly, and it is the reason a cookie count in the hundreds of thousands is a more alarming number than a credential count in the thousands.
The second point is structural. Shared multi-tenant webmail is a single point of failure with a government-wide blast radius. Jewelbug did not breach 15 ministries; it breached one platform and inherited 15 ministries. Any organization operating shared web infrastructure across independent tenants should read the write access Jewelbug obtained to a common template as the whole incident, and everything downstream as consequence.
Third, the espionage-and-fraud fusion breaks a common triage assumption. Crypto scam infrastructure, click-fraud bots and SEO poisoning aimed at Chinese-speaking crypto users are typically deprioritized as commodity crime. Here they share a C2 panel with a government espionage campaign. An indicator that looks like scam traffic may be the same operator that is inside a ministry mailbox.
The Attack Technique
Per BleepingComputer's account of the Symantec research, the chain ran as follows. Jewelbug gained write access to the shared webmail installation and inserted a malicious script into its common template. The script then executed on login pages and mailbox views across all affected tenants.
On execution, the script opened a WebSocket connection to attacker command and control, exfiltrated webmail cookies, and read the user's email address to determine whether it belonged to a targeted government domain. Visitors judged valuable were served a fake Adobe Flash update prompt, which installed the main Windows payload, the Antino backdoor, plus browser tooling. Everyone else was left alone, which is both good tradecraft and a reason the campaign ran long enough to accumulate a million check-ins.
The toolset described across sources:
- Antino: the primary Windows backdoor, delivered via malicious HTA files and fake Adobe Flash/Adobe installers, then used to stage further payloads.
- ClientKing: a Linux backdoor, described by OffSeq as a Linux/router implant.
- PDF Viewer: a malicious Chrome and Firefox extension that requests every permission it can and functions as a full browser takeover, capable of injecting arbitrary JavaScript into any page, escaping the browser sandbox, and driving the browser as if the operator were sitting at the keyboard. SC Media adds that it can potentially replace cryptocurrency addresses mid-transaction, the direct bridge between the espionage and fraud sides.
- XG-Web: the browser-centric remote-access and information-stealing framework that serves as the single operator panel for both missions. Symantec notes five generations of in-house development.
- A helper component disguised as a Microsoft Edge component, which Symantec says gave operators a command shell on the host.
On the fraud side, the scale is described inconsistently: Dark Reading says the group manages hundreds of fake cryptocurrency exchanges, while SC Media and BleepingComputer describe thousands of fake cryptocurrency and betting websites boosted by click-fraud bots and victim-filtering logic. The order of magnitude is disputed; the industrial character of the operation is not.
What Organizations Should Do
- Audit write access to shared web templates. Any file that renders on a login page or mailbox view across multiple tenants is a top-tier asset. Enforce integrity monitoring on common template directories and alert on any change, not just changes outside a deploy window.
- Hunt for outbound WebSocket connections from webmail-facing pages. The initial exfiltration channel was a WebSocket to attacker C2 established from within the browser session. Baseline what your webmail should legitimately connect to and alert on the rest.
- Treat session cookies as credentials. Shorten session lifetimes, bind sessions to device or network attributes where feasible, and build a mass session-revocation capability you can trigger for an entire tenant. MFA alone did not help these victims.
- Lock down browser extension installation. PDF Viewer was the primary lure and the deepest access. Move to an enterprise allowlist for Chrome and Firefox extensions and alert on any extension requesting broad host or cookie permissions.
- Treat any in-browser "Adobe Flash update" prompt as an incident. Flash has been end-of-life for years. A prompt for it on a government webmail page is a targeting signal, not a nuisance, and should be reported by users and investigated.
- Ingest the published indicators and hunt retrospectively. OffSeq lists IOCs including IP 38.12.1.47 and the domains www.jkskhei.com and ns1.jkskhei.com alongside a set of file hashes. Given a three-month collection window with a million check-ins, search historical telemetry rather than assuming current-state cleanliness.
- Do not dismiss crypto-scam indicators as commodity noise. Where infrastructure overlaps between fraud and espionage, a low-priority alert may be your only early warning of the higher-priority intrusion.
Sources: Hackers breach govt webmail while running parallel crypto fraud | 'Jewelbug' APT Balances State Espionage & ... | Researchers Link Suspected Chinese APT to Hack-for-Hire Operations... | China-linked Jewelbug group conducts espionage and cryptocurrency t... | Jewelbug: APT Group Runs Espionage and Crypto Fraud ... | Jewelbug APT Hijacks Browsers to Steal Cookies and Spy on Governmen... | APT Group Runs Espionage and Crypto Fraud Operations Side by Side -... | Jewelbug: XG-Web Infrastructure Supporting Government Webmail Compr...