Jewelbug Hacker Group Engages in Espionage and Cryptocurrency Fraud

The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in cryptocurrency fraud. Researchers at Symantec found that the threat actor targeted government agencies and organizations in critical sectors, including defense, telecommunications, education, and aviation.

The group compromised webmail accounts belonging to 15 government tenants as part of a campaign targeting a country in the Middle East. A malicious script was inserted into the shared webmail installation, which ran on login pages and mailbox views across all 15 tenants.

After execution, the script established a WebSocket connection to the attacker's command-and-control server, exfiltrated webmail cookies, and retrieved the user's email address to determine whether it belonged to a targeted government domain. The threat actor used an automated attack pipeline that scrapes keywords, generates fake download pages using AI, and publishes them across hundreds of lookalike domains impersonating OKX and Binance.