Jewelbug: government mailboxes by day, fake crypto exchanges by night
Symantec has published the inside of a Chinese hacking operation that runs two businesses from one control panel. One steals from government mailboxes across Asia and the Middle East. The other runs hundreds of fake cryptocurrency exchange websites aimed at ordinary Chinese speakers.
The same people, the same infrastructure, the same database. More than a million infected-machine check-ins, over 580,000 stolen browser cookies, and a compromise that reached fifteen government email tenants through a single shared platform.
↓ Download one-page brief (PDF)Write access to a shared webmail platform
The group obtains write access to a national webmail installation shared by multiple government departments, and inserts a malicious script into the platform's common template - the file that renders every login page and mailbox view. One change reaches every tenant on the platform.
The script sorts the visitors
When a user loads a page, the script opens a connection to the attackers' server, takes their webmail cookies, and reads their email address to see whether it belongs to a government domain on the target list. Ordinary users are left alone.
The valuable ones get a fake update
Users identified as worth pursuing are shown a bogus Adobe Flash update prompt. Accepting it installs the group's main Windows backdoor and its browser tooling.
A browser extension that takes everything
The extension is presented as a PDF viewer. Instead it requests effectively every permission a browser can grant, then harvests cookies, live session tokens, browsing history, screenshots and traffic, and hooks login forms to capture credentials as they are typed. It can also substitute cryptocurrency addresses during a transaction.
The other business, from the same panel
The same operators run a registered Chinese company advertising search-ranking services, which Symantec assesses is a front. AI-generated pages impersonating OKX and Binance are pushed up search results by click-fraud bots running across dozens of servers, and visitors download either a trojanised exchange client or the same PDF Viewer extension.
Symantec gets inside the panel
Investigators obtain visibility of the group's control platform, database, server logs, source code and operator files. The database holds more than a million implant check-ins, over 580,000 stolen browser cookies and more than 2,300 exfiltrated email bodies, with around 1.1 million geolocation events from 4,300 distinct addresses.
Poisoning a place people already go
Rather than sending a link to a target, the attacker compromises a site the target visits anyway and waits. Here the site was the government's own webmail. No one had to be tricked into clicking anything unusual, which is why awareness training does not help.
The thing that replaces your password
After a successful login, a site issues the browser a token proving the session is authenticated, so the user is not asked again on every page. Steal that token and you inherit the session - password unknown, second factor already satisfied.
Permissions as the giveaway
A browser extension can only do what it is granted permission to do. One that asks for everything in order to display a PDF is asking for far more than its stated function requires, and that mismatch is the visible signal available to a user or an administrator.
Where state work and crime share an office
Symantec frames Jewelbug as a mercenary outfit. That model - contractors doing state work and keeping a private business on the side - is well documented in the Chinese ecosystem, and it explains an operation that would otherwise look incoherent.
The two halves are not really separate. The crypto fraud funds and staffs the operation, the espionage gives it capability and tooling, and both run through one panel and one victim database. Treating the criminal activity as noise around the state activity misreads what this organisation is, which is a business with two customers.
The shared platform is the finding, not the malware
Fifteen government tenants were reached by editing one template file on one shared installation. No individual department was targeted, tricked or breached in its own right. The exposure was created by the hosting decision, and it existed before any attacker arrived. Any government or group of organisations sharing a mail platform, an identity provider or a document system has the same concentration, and it will not appear in any single tenant's risk register.
Session-token theft is the practical defeat of multi-factor authentication
Multi-factor authentication is the single most effective control most organisations deploy, and it is defeated here without being attacked. The token is taken after the check has passed. The consequence is that "we have MFA" is no longer a sufficient answer, and that incident response must include invalidating sessions rather than only resetting passwords.
Espionage and crime in one organisation degrades attribution for everyone
The same panel, operators and database serve a state-aligned intelligence mission and a fraud business. That makes an intrusion harder to classify at the point of detection, and a defender who concludes "this is criminal, not state" may be wrong in a way that changes the entire response. It is a realistic possibility that the blending is partly deliberate for that reason, though Symantec does not claim it.
The attribution is a vendor assessment, and it is unusually well evidenced
Symantec ties an operator to a registered Hunan company and names its legal representative from identity documents recovered from the operators themselves. That is far stronger than the infrastructure-overlap reasoning most attribution rests on. It still stops short of establishing state direction, which Symantec words carefully as work that must surely be at the behest of a nation-state, most likely China. No government has attributed the activity.
The method is repeatable and the target class is expanding
Shared government platforms exist everywhere, browser extensions remain a weakly governed attack surface, and session-token theft works against almost everyone. It is highly likely that watering-hole compromise of shared national platforms continues, and likely that further contractor groups are found running commercial crime alongside state collection, because the economics of the model favour it.
Set this beside Kimsuky, where a North Korean group moved AI tooling onto its own hardware to escape the providers who could watch it. Both cases show a state-linked actor operating in a space where nobody has clear responsibility for looking - there a provider's safety controls, here the boundary between a criminal investigation and a counter-intelligence one. The gap being exploited in each case is institutional, not technical.
- Ask who else is on your platform. If your organisation's email, identity or document system is shared with others, your exposure includes theirs. That question belongs to whoever signs the hosting contract, not to the security team alone.
- Make session invalidation part of your incident response. Resetting passwords does not evict an intruder holding a live session token. Know how to force re-authentication across your estate, and test that you can.
- Govern browser extensions like software, because they are. An extension can read everything the browser sees. Most organisations control what is installed on the machine and not what is installed in the browser.
- Treat a permissions request that exceeds the function as the signal. A PDF viewer asking for access to all sites, all data and all tabs is describing what it intends to do. Users and administrators can both see that, and it is one of the few visible warnings in this chain.
- Expect an unexpected update prompt to be the attack. A fake Flash update was the step that installed the backdoor. Software should update through managed channels, and a prompt that arrives while reading email should be treated as hostile by default.
- Do not let the classification of an intrusion drive the response too early. A compromise that looks like commodity crime may be run by the same people reading government mail. Classify late, and preserve evidence as though attribution matters.
- https://www.security.com/threat-intelligence/jewelbug-crypto-fraud-espionage
- https://www.bleepingcomputer.com/news/security/hackers-breach-govt-webmail-while-running-parallel-crypto-fraud/
- https://www.darkreading.com/threat-intelligence/jewelbug-apt-state-espionage-cryptocurrency-theft
- https://www.scworld.com/brief/china-linked-jewelbug-group-conducts-espionage-and-cryptocurrency-theft
- https://cryptobriefing.com/jewelbug-espionage-crypto-fraud-symantec/
Compiled from open-source reporting for professional security discussion. This is a security vendor's research finding. The attribution to China rests on Symantec's analysis, including operator identity documents and a registered Hunan company; Symantec words the state connection as work that must surely be at the behest of a nation-state, most likely China, rather than as an established fact, and no government has attributed the activity. The victim organisations, the compromised telecommunications provider and the affected government departments have not been named. The exchanges impersonated in the fraud operation, and the browser and software vendors whose products were abused, were not compromised and are not implicated. Technical indicators are not reproduced here. Details may be revised. This is a protective-security lessons-learned assessment, not an operational account.