China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud
Summary: Symantec and Carbon Black's Threat Hunter Team reported that Jewelbug, a China-linked hackers-for-hire group, runs government and military espionage and for-profit cryptocurrency fraud from a single control panel called XG-Web, a browser-centric remote-access and information-stealing framework. The group has developed five generations of command-and-control code and implants spanning browsers, Windows endpoints, Linux servers and network devices, and its largest espionage operation compromised a web hosting provider to inject JavaScript into webmail used by 15 government tenants tied to a Middle Eastern government.
What you should know: The campaign collected more than one million implant check-in rows, over 580,000 stolen browser cookies, several thousand captured credentials and at least 2,300 exfiltrated email bodies, with roughly 1.1 million geolocation events logged against about 4,300 distinct source IP addresses. The same team and infrastructure behind foreign government and military espionage also run a commodity crypto fraud business, so a single browser extension named "PDF Viewer" serves both missions.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026