Jewelbug: Inside the Dual-Purpose Espionage and Cryptocurrency Fraud Operation

Dual-Purpose Operations from One Platform

XG-Web is a three-tier browser-centric C2 panel built with a React frontend, Node.js backend, and MySQL database, using hybrid RSA-2048/AES-256 encryption over WebSocket Secure. The group's own internal documentation drops any pretense of "authorized penetration testing" and describes functions in plain terms: "browser hijacking," "data theft," "man-in-the-middle attack," and silent webcam/microphone listening .

Government Espionage Campaigns

• Middle Eastern telecom shared-hosting compromise — Jewelbug injected malicious JavaScript into a shared webmail template operated by a Middle Eastern state telecommunications provider, hitting over 15 government webmail tenants simultaneously . This script stole browser cookies and pushed fake Flash/Adobe updates, deploying the Antino backdoor, malicious browser extensions, and Linux/router implants .
• Southeast Asia targeting — Confirmed campaigns against navy, police, and army intelligence bodies in the region .
• U.S. aerospace manufacturer — A major unnamed American aerospace company was among the espionage targets .

AI-Powered Cryptocurrency Fraud

• Fake exchange pages — SEO-poisoned sites impersonating OKX and Binance, with lure imagery generated through a Chinese AI image service whose embedded content-generation ID tied back to the operator's account .
• Malicious "PDF Viewer" browser extension — A Manifest V3 Chrome / Manifest V2 Firefox extension that requests nearly the entire dangerous extension API, silently replaces cryptocurrency wallet addresses, and provides operators an OS command shell via a native-messaging helper (com.microsoft.runedge) .
• Over 40 content-management servers — The handle "paopaodada" paired with the password 525xiaoxiao was reused as the admin login across a fleet of 44 CMS servers and as a bulk domain registrant .

Scale of the Operation

The group's recovered victim database logged over one million implant check-ins, more than 580,000 stolen browser cookies, and over 2,300 exfiltrated email bodies between February and May 2026 . This scale highlights how effectively a small hackers-for-hire crew can run simultaneous espionage and fraud operations using shared infrastructure.

Attribution

Symantec assesses with high confidence that the cryptocurrency fraud arm is run by a named individual — the sole legal representative of a company registered in Changsha County, Hunan Province, China (founded 2019, described as an SEO business). The individual used the handle "paopaodada" (泡泡大大) and advertised a "website ranking rental" service on Telegram against a Binance-branded image. Symantec recovered the operator's real-name government-issued ID verification documents, a business license, and a signed/stamped media-platform authorization letter .

No direct evidence links Jewelbug to the Chinese state, but Symantec notes the targeting — government ministries, military intelligence, a U.S. aerospace manufacturer — makes other explanations unlikely . Whether the same individual operated the espionage campaigns is not established, but both activities shared the same infrastructure, overlapping page-cloaking code, an aligned timeline, and the same XG-Web panel. Symantec assesses it most likely that the SEO business supplied access, delivery, and infrastructure into the espionage operation .

Uneven Operational Security

The group left a significant trail of evidence due to poor opsec :

• The operators repeatedly tested their stealer against their own browsers, collecting nearly as much data on themselves as on their victims, including:
  • The cleartext password to their own C2 panel and its 2FA seed
  • Live operator session tokens and bcrypt password hashes
  • The developer's Windows username and test hostname
  • Credentials for a Chinese-language hacking forum (t00ls.com)
• Development artifacts in the codebase included the local phpStudy WAMP path (C:\phpstudy_pro\WWW\), the production path (/data/xg-web/backend/), and a developer LAN address that the implant's own code explicitly excluded from capture.
• The VPN client was installed locally at D:\工作软件\vpn最新\ on a Windows NT 10.0.26200 host, with logs showing a working pattern concentrated between 13:00–01:00 UTC+8, routing set to bypass mainland China — consistent with an operator physically inside China.
• Installed software notes referenced Clash/Shadowrocket (Great Firewall circumvention), AnyDesk/ToDesk, LDPlayer Android emulator, and DeepSeek. Telegram Desktop session data tied one operator to the account used to advertise the group's commercial services.

Key Takeaways

• Jewelbug is a China-based hackers-for-hire group that ran government espionage and cryptocurrency fraud from a single command-and-control panel called XG-Web.
• The operation compromised over 15 government webmail tenants in the Middle East, targeted Southeast Asian military and police bodies, and hit a U.S. aerospace manufacturer.
• The cryptocurrency fraud used AI-generated fake exchange pages and a malicious browser extension to steal wallet addresses.
• Symantec identified the individual behind the crypto fraud arm using government-issued ID and a business license, but found no direct link to the Chinese state.
• Poor operational security — including operators testing malware on their own machines — provided investigators with extensive evidence.