Jewelbug Group Stole 580k Cookies and Targeted Chinese Crypto Users

Symantec identified Jewelbug’s dual espionage and crypto fraud ops, citing 1M login attempts and 580k stolen cookies in under three months using shared infrastructure.

Woofun AI reports that Symantec's Threat Hunter Team identified the 'Jewelbug' hacker group as conducting simultaneous cyber espionage and cryptocurrency fraud. The group utilized the XG-Web control panel to target government entities in Middle Eastern, Southeast Asian, and South Asian nations while running scams against Chinese speakers. Data indicates over 1 million program login attempts and more than 580,000 stolen browser cookies were recorded in less than three months. Researchers linked an operator to a registered company in Hunan via identity documents.

The group employed the 'Antino' backdoor and malicious browser extensions disguised as 'PDF Viewers' for data theft. In one instance, watering hole attacks compromised over 15 government email accounts in a Middle Eastern country. Cryptocurrency fraud operations centered on a Changsha-based company advertising 'website ranking rental' services on Telegram. This entity used artificial intelligence to generate fake exchange download pages and registered hundreds of domains mimicking OKX and Binance for phishing. Analysts suggest the shared infrastructure implies fraud operations support espionage activities.