Jewelbug's Espionage and Cryptocurrency Fraud Operations Exposed by Symantec
A Chinese hacker-for-hire group known as Jewelbug has been identified as conducting simultaneous government espionage campaigns and cryptocurrency fraud operations. According to findings published by Symantec’s Threat Hunter Team, Jewelbug employs the same infrastructure for both activities, merging state-level surveillance tools with fraudulent crypto exchange websites designed to siphon funds from victims.
The scale of Jewelbug’s operations is significant, with their centralized command-and-control system, referred to as XG-Web, tracking over one million implant check-ins from victims. The group has reportedly stolen more than 580,000 browser cookies and exfiltrated over 2,300 email bodies, all while operating with a relatively small team that utilizes role-based access controls.
Active since mid-2023, Jewelbug, which also goes by the names Earth Alux and REF7707, primarily targets government entities in regions such as the Middle East, Southeast Asia, South Asia, and Taiwan. One notable campaign involved the deployment of a malicious script across more than 15 government webmail tenants on a shared hosting platform, a tactic known as a waterhole attack.
In addition to its espionage efforts, Jewelbug has established a financial crime operation that includes the registration of hundreds of lookalike domains and the creation of thousands of fake downloads for cryptocurrency exchanges. These fraudulent sites, generated using AI, predominantly target Chinese-speaking individuals.
The group’s crypto fraud operations rely on a malicious browser extension that not only harvests user credentials but also features a clipboard module capable of swapping cryptocurrency wallet addresses without the user’s knowledge. This means that when a victim copies their intended wallet address and pastes it into a transaction, the extension can silently replace it with an address controlled by Jewelbug.
Jewelbug’s technical arsenal includes the Antino Windows backdoor and the aforementioned browser extension, both of which are custom-built. However, the group also employs common cybercrime tactics such as SEO poisoning, manipulating search engine results to elevate malicious websites in searches for popular cryptocurrency platforms.
The XG-Web command-and-control platform serves as the operational hub, managing both espionage implants on government systems and coordinating the fake crypto exchange campaigns. Previous reports dating back to October 2025 had already flagged Jewelbug’s attacks on geopolitical targets, but the addition of cryptocurrency fraud introduces a new dimension to their operations.
The clipboard-swapping technique exploits a common user behavior that is often perceived as a security measure. Copying and pasting a wallet address is typically seen as a way to prevent errors, but Jewelbug has turned this practice into a vulnerability. The extensive registration of lookalike domains indicates that this operation is not merely targeted; it resembles a dragnet approach, potentially affecting a vast number of unsuspecting victims.
