Jewelbug APT Hijacks Browsers to Steal Cookies and Spy on Government Networks

Cybersecuritynews •Tushar Subhra Dutta • August 13, 2026

Jewelbug has turned ordinary web browsing into an entry point for espionage. The China-based group compromised government webmail systems, stole browser cookies, and used that access to watch activity inside affected networks. Its campaigns reached ministries and targets across the Middle East, Southeast Asia, and South Asia. In one major incident, a malicious script was […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Jewelbug APT Group Engages in Espionage and Cryptocurrency Fraud The Jewelbug APT group, based in China, has been conducting simultaneous cyber espionage and cryptocurrency fraud operations. Utilizing a single command-and-control platform named XG-Web, the group has compromised over 15 government webmail accounts across multiple countries in the Middle East and Asia. Their operations have resulted in the theft of more than 580,000 browser cookies and over 2,300 email bodies. The group employs a malicious browser extension called 'PDF Viewer' that steals sensitive information and can replace cryptocurrency wallet addresses during transactions. Jewelbug's activities have targeted government, military, and telecommunications sectors, indicating a significant scale of operations. The group has registered hundreds of fake cryptocurrency exchange websites, primarily targeting Chinese-speaking victims. Symantec's research highlights that Jewelbug's dual operations blur the lines between state-sponsored espionage and cybercrime for profit. 15 sources 78

Extracted Entities

Jewelbug APT Hijacks Browsers to Steal Cookies and Spy on Government Networks

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Industries (1)

MITRE ATT&CK (1)