XG-Web: Spy Operations and Crypto Fraud From One Dashboard
At the center of Jewelbug's operation is a custom command-and-control platform called XG-Web — a browser-centric remote-access and information-stealing framework built on a React frontend, a Node.js backend, and a MySQL database that served as the rendezvous point for all victim implants. Symantec obtained access to the platform's backend logs and source code, which is what produced the detailed scale figures.
Internally, Jewelbug described XG-Web as "Xiang Ge — Security Testing Platform," a description its actual use directly contradicted: internal documentation for the platform listed its functions as "browser hijacking," "data theft," and "man-in-the-middle attack." The platform used role-based access controls with superadmin, admin, and ordinary user tiers. Lower-level operators could only see the victims they personally infected — a design that mirrors legitimate enterprise software-as-a-service more than it does the chaotic underground forums typically associated with cybercrime.
The same platform administered both missions. Tabs within XG-Web managed espionage campaigns against government and military targets. Other sections managed the group's cryptocurrency fraud business: a pipeline of hundreds of fake OKX and Binance download portals, an AI-generated article system that produced thousands of fake exchange pages, and a fleet of 44 content management servers pushing that material across the internet. Click-fraud bots manipulated search engine rankings to surface the fraudulent pages ahead of legitimate results; a PHP-based cloaking system showed search engine crawlers harmless content while redirecting real human visitors to the malware. The fraud operation also used sports betting portals, pirated livestream sites, and fake private-detective services as additional lures.
A scheduled task within XG-Web automatically checked the group's own command-and-control domains against VirusTotal every 12 hours, allowing operators to rotate away from any domain that had been flagged before it could be blocked at scale.
The Full Malware Stack
Jewelbug's technical toolkit spans the full attack surface of a modern enterprise network — desktop operating systems, server operating systems, network routers, and web browsers.
Antino, the group's primary Windows backdoor, was delivered via malicious HTML Application (HTA) downloaders themed on current geopolitical events, including a lure impersonating an invitation to a Center for Strategic and International Studies Indo-Pacific Forecast 2026 event — a Washington-based think tank focused on defense and foreign policy. Antino was also delivered disguised as a fake Adobe Flash installer. Once running, Antino uses the Microsoft Graph API as its command-and-control channel, hiding its traffic inside legitimate Microsoft cloud infrastructure unlikely to be blocked by reputation-based filtering. This technique is not unique to Jewelbug — multiple advanced persistent threat groups adopted Graph API command-and-control abuse in 2025 and 2026 precisely because legitimate cloud API traffic is difficult to distinguish from malicious communications at the network perimeter.
For Linux servers and network routers, the group deployed ClientKing: a Rust-based implant with 37 builds spanning x86-64 servers, ARM64 devices, and ASUS consumer routers. ClientKing supported five separate command-and-control transport channels, including a custom DNS tunnel, and offered a full interactive shell, SOCKS proxy pivoting, and the ability to load kernel modules directly from memory. A companion toolkit added a kernel-module rootkit and a malicious authentication module hooked into the Linux su and sudo commands to harvest credentials at the moment of elevation. Some builds were configured to route communications through the internal corporate proxy of a major US aerospace and industrial manufacturer — meaning that victim's network was being used as both a data source and a relay point for further operations, per Symantec's full technical dossier.
For payload delivery, Jewelbug's backend created public Google Docs documents containing obfuscated payloads, XOR-encoded with a random key on every request so no two downloads were identical. Implants fetched the documents and executed the payloads — using Google-owned infrastructure as a delivery channel unlikely to be blocked.
Targets: Government, Military, Aerospace, and Crypto Users
Jewelbug's espionage campaign list — which Symantec obtained and examined — covered government organizations across the Middle East and Southeast Asia, more than 90 police and government email addresses in South Asia, and decoy documents styled after Taiwanese government bodies, suggesting an intelligence mandate that extends to the Taiwan Strait. Runtime server logs recorded approximately 87,200 connections from networks within one Southeast Asian country targeting state telecom and military infrastructure, approximately 53,100 from a Middle Eastern country across national carrier ranges, and approximately 15,000 from a second Southeast Asian country including government ministry infrastructure, according to Symantec's published server log analysis.
The October 2025 Symantec report on Jewelbug covered the group's five-month intrusion against a Russian IT service provider, which ran from January through May 2025. Attackers had access to that provider's code repositories and software build systems — positioning they could have used to carry out supply chain attacks against the provider's Russian customers. By December 2025, researchers at multiple firms were reporting Jewelbug-linked activity against government entities and telecommunications organizations across Europe, Asia, and Africa.
The Hunan Connection and the Contractor Model
Symantec confirmed that at least one of Jewelbug's operators is linked to a registered company in China's Hunan Province — specifically in Changsha — and identified the individual through government-issued identity documents, a company business license, and signed and stamped authorization letters found in the group's own infrastructure. That individual openly advertised a "website ranking rental" service on Telegram under the handle "paopaodada" (Bubble Boss) and reused that handle as the administrator login across the fleet of content management servers running the crypto fraud operation, as documented in Symantec's full attribution findings.
Symantec's assessment is that the SEO and infrastructure business supplied access and delivery to the espionage operation rather than that one person was personally conducting the government hacking. The precise relationship between the identified individual and the operators running the espionage campaigns was not fully established.
Dick O'Brien, principal intelligence analyst for Symantec's Threat Hunter Team, stopped short of confirming direct government direction but was clear about what the evidence supports. "Given their location and their targeting, by far the most likely scenario is that they are working for China," O'Brien said. The group could be operating under direction from a Chinese state agency or conducting operations on its own initiative and selling the resulting intelligence to government clients — both arrangements fit the documented pattern.
The Chinese government has constructed an extensive privatized cyber-operations ecosystem in which independent companies carry out espionage on behalf of state intelligence agencies, providing Beijing with scale and plausible deniability. Jewelbug fits that model — but with a documented variation, as outlined in the DOJ indictment of 12 Chinese hackers in March 2025. O'Brien noted that the contractors' financial sidelines create security problems for the states that employ them. "You have less oversight over operations. And financially motivated hackers aren't usually the most trustworthy people. Their operational security also tends to be a lot poorer," he said. "As evidenced by Jewelbug, who left a trail of evidence behind them."
Operator Tradecraft and What Got Them Caught
Jewelbug's operators work from inside China. Their VPN routing profile bypasses mainland-Chinese destinations while tunneling all other traffic — the behavior of a user circumventing domestic internet filtering rather than concealing a foreign origin. Their working pattern is concentrated in the afternoons and late evenings of the UTC+8 time zone. Their operational discipline was uneven: they repeatedly tested their own stealer against their own browsers, ran the XG-Web panel in development mode on a live production server, and reused a single credential set across the panel and the commercial server fleet. That sloppiness — not sophisticated investigation — is what allowed Symantec to reconstruct the full operation.
What Defenders Need to Do Now
The Jewelbug disclosure carries actionable implications for several distinct populations.
Government IT administrators running shared national hosting platforms should treat the shared infrastructure itself as a potential attack surface, not just the agencies it hosts. A single vendor compromise enabling simultaneous access to all of a government's communications infrastructure is not a theoretical attack vector — it is now documented at scale. Supply-chain-style security reviews of shared hosting providers, webmail platforms, and government network services agencies are warranted.
Enterprise security teams should add the detection of Microsoft Graph API calls from unexpected processes to their monitoring priorities, and should audit browser extension installations on managed devices — particularly extensions requesting native messaging, debugger access, or cross-site cookie permissions. ClientKing's DNS tunneling also warrants network-level detection: monitoring for anomalous IPv6 AAAA record lookups against unknown domains from server processes is a practical starting point.
Cryptocurrency users should verify exchange URLs independently rather than through search engine results, which Jewelbug specifically manipulated to surface fraudulent pages. Clipboard-hijacking wallet address substitution — the capability the group built but did not deploy in this campaign period — is a documented attack technique against crypto users; hardware wallets that display transaction destination addresses on the device screen provide a practical mitigation.
Symantec has published Jewelbug indicators of compromise covering file hashes, network infrastructure, and registry artifacts. Security teams should incorporate those indicators into detection tooling immediately.
Frequently Asked Questions
What is the Jewelbug hacker group, and who is behind it?
Jewelbug is a China-based hack-for-hire operation documented by Broadcom's Symantec Threat Hunter Team in a report published August 13, 2026. It is also tracked as Earth Alux by Trend Micro, REF7707 by Elastic Security Labs, and CL-STA-0049 by Palo Alto Networks Unit 42, and has been active since at least the second quarter of 2023. At least one of its operators is linked — via government-issued identity documents — to a registered company in Changsha, Hunan Province. Symantec assesses with high confidence that the group is working for China, most likely for a state intelligence client, though the specific agency has not been confirmed. The group's operators work during afternoon and late-evening hours in the UTC+8 time zone and run VPN configurations consistent with circumventing mainland Chinese internet filtering, per Symantec's full investigation.
Can my organization's browser session be compromised even with two-factor authentication enabled?
Yes — and Jewelbug's operation demonstrates exactly how. MFA protects the authentication event itself: the moment a user proves their identity with a password and second factor. It does not protect what happens inside the browser session once authentication has completed. A malicious browser extension installed after the authentication step operates entirely within the authenticated session boundary and has access to everything that session can reach — cookies, open pages, internal resources. Jewelbug collected more than 580,000 government browser session tokens in fewer than three months, in environments where MFA was nominally active. Mitigations include restricting browser extension installations on managed devices via policy, auditing extensions for permissions like native messaging and cross-site cookie access, and implementing short session token lifetimes with forced reauthentication.
How does Jewelbug's cryptocurrency fraud actually work, and am I at risk?
Jewelbug runs an automated pipeline that generates thousands of fake download portals impersonating OKX and Binance, publishes them across a 44-server content management fleet, and uses click-fraud bots to manipulate search rankings so those pages appear ahead of legitimate results. A PHP-based cloaking system hides the malicious content from search engine crawlers while redirecting real human visitors. The operation targets Chinese-speaking users primarily, but the technique — SEO poisoning of crypto exchange searches — is not geographically limited. Practical protections: bookmark the direct URLs of any crypto exchange you use, never navigate to exchanges through search results, verify exchange URLs character by character before entering credentials, and use hardware wallets that display transaction addresses on the device screen (to defeat clipboard-hijacking address substitution, a capability Jewelbug built and staged during this campaign period), as documented in BleepingComputer's technical breakdown.
What does the Microsoft Graph API have to do with this, and why does it matter?
The Microsoft Graph API is the programming interface through which applications interact with Microsoft 365 services — email, calendars, files, and cloud storage. Jewelbug's Antino Windows backdoor routes all its command-and-control communications through this API, embedding instructions and data inside what appears to be ordinary Microsoft cloud traffic. Because the traffic originates from and terminates at legitimate Microsoft infrastructure, traditional perimeter defenses that block connections to unknown or malicious domains do not flag it. Jewelbug is not alone in using this technique: Group-IB's July 2026 HollowGraph disclosure documented multiple advanced persistent threat groups adopting Graph API abuse as a command-and-control method in 2025 and 2026. Detection requires behavioral monitoring — identifying processes that make Graph API calls when they have no legitimate business reason to, or monitoring for unusual data volumes in Microsoft cloud service logs — rather than relying on network-layer blocking.
