← News
/PLAYBOOK · 2026-08-18

Jewelbug APT Dual-Track Ops: Script Hijack of 15-Nation Government Webmail, Parallel Cryptocurrency Fraud on Same C2 Panel

Symantec discloses China-nexus APT Jewelbug (Earth Alux/REF7707) injected JavaScript into shared webmail templates, hijacking accounts at 15 Middle Eastern government agencies. Same C2 panel concurrently runs OKX/Binance clone phishing for crypto fraud.

Incident Overview

Broadcom's Symantec Threat Hunter team published on 13 August a report on China-nexus APT Jewelbug (also Earth Alux, REF7707). The group injected JavaScript into shared government webmail platform templates, hijacking mailbox accounts of 15 government-agency tenants in a Middle Eastern country, stealing more than 580,000 browser cookies and 2,300 full email bodies. On the same attack chain the group concurrently ran OKX and Binance lookalike crypto phishing sites, AI-generated content sites, and click-fraud bots—espionage and fraud sharing one C2 panel. Rare dual-track ops.

Technical Details

Initial access was not the mail servers. It was the underlying shared webmail hosting platform. Attackers obtained write access to a shared webmail platform operated by a Middle Eastern national telecom and the national network services bureau, then planted a script tag in the common page template referencing fonts.chrorne[.]com. The CDN hostname spoofs a fonts.chrone.com-style font origin. Routine security review easily treats it as a legitimate static-asset load and allows it. After injection, all 15 government tenants execute that JavaScript on every load of the mailbox login page and inbox view. The script opens a WebSocket to C2, steals page cookies, listens for cookie-change events to intercept new session tokens, and reads the logged-in username and mailbox address.

For accounts on 9 government domains listed as high-value targets, Jewelbug overlaid a fake Adobe Flash update prompt on the original page. Click installs the Antino backdoor plus a malicious Chrome/Edge extension named PDF Viewer. Antino maintains a command channel via Microsoft Graph API. The PDF Viewer extension steals cookies, intercepts HTTPS traffic, and remotely controls the browser. After entering one Jewelbug C2 admin panel, Symantec inventoried the victim database: more than 1 million implant callbacks, more than 580,000 stolen cookies, thousands of credential sets, more than 2,300 full email bodies.

The same C2 panel also ran Jewelbug's fraud business: AI-generated lookalike pages for OKX, Binance, and other crypto exchanges, plus click-fraud bots to fake search-result ranking for traffic; also sports betting and private-investigator scam content. Symantec attributed the fraud infrastructure to a Changsha tech company that does public-channel SEO. Early investors and operators of the crew have direct ties to that Changsha company.

Impact Assessment

Jewelbug's paradigm breaks the traditional APT-espionage vs. economic-crime boundary. Two attack lines that should be fully isolated are folded onto one C2 panel. Direct challenge to defender hunting and attribution. On the espionage side: 15 government tenants hit via a shared template means one write-access grab converts into zero-interaction account takeover at 15 agencies. Cross-tenant data convenience becomes the cross-org pivot. On the crime side: legitimate-looking font CDN hostname + shared-platform template + long-lived WebSocket is a three-layer combo that cuts victim detection probability. Fake Adobe Flash upgrade—classic 2010s social engineering—still works in 2026 targeted ops.

Deeper impact: browser cookies carry authenticated sessions, so MFA is fully inert in this model. No password, no OTP. One intercepted cookie bypasses all login checks. Same logic as 2025 EvilProxy, Tycoon 2FA, and other AiTM phishing kits, but the Jewelbug variant is cheaper: no phishing page, no lure mail, code runs on a real domain the victim already trusts. Signature upgrade of current cybercrime industrialization. MITRE ATT&CK covers the path under T1539 (Steal Web Session Cookie). NIST SP 800-63B states session management is a control independent of authentication, requiring bounded lifetime and on-demand reauthentication.

Remediation

For government and regulated-industry IT security teams:

For individuals and enterprise users: keep browser and OS patched. Enable built-in browser sandbox isolation. Government/defense/finance staff: mandatory separate browser profile for mail. Zero-trust on all "please install update" popups.

References