PDF Viewer (Jewelbug browser extension)

Jewelbug: one script tag in a shared government webmail template put a watering hole on 15+ ministry tenants at once, and the browser extension it drops escapes the sandbox through a native-messaging host named after Microsoft Edge

Symantec's Threat Hunter Team has published the results of a months-long investigation into Jewelbug, a China-based hack-for-hire group that runs two missions from one set of hands: espionage against government ministries and militaries across the Middle East, Southeast Asia and South Asia, and a for-profit cryptocurrency-fraud business aimed at Chinese-speaking victims. Both are administered from a single control panel called XG-Web, a browser-centric remote-access and information-stealing framework built as a React panel over a Node.js backend with a MySQL database that doubles as the rendezvous point for victim implants; its developers describe it in their own documentation as a "penetration-testing platform", while its internal function names include browser hijacking, data theft and man-in-the-middle attack (Symantec, 2026-08-13). Symantec assesses with high confidence that the fraud and search-engine-optimisation arm is run by the sole legal representative of a registered Changsha company, on the basis of government-issued identity documents, a business licence and a signed authorisation letter recovered from the operators, and considers it most likely that the SEO business supplied access, infrastructure and delivery to the espionage operation rather than one person performing both roles (Symantec, 2026-08-13).

The access pattern is the finding. In its largest espionage operation, Jewelbug did not attack ministries individually. It compromised the shared web-hosting platform run by a Middle Eastern state telecommunications provider and national network-services agency, obtained write access to the common webmail installation, and added one script tag — planting a watering hole on every government tenant on that platform at once, in a single campaign that spanned more than 15 tenants (Symantec, 2026-08-13). Symantec infers the tag sat in the shared template rather than being delivered per user because the hook fired on the login page and on every mailbox view. The group also hooked the hosting provider's own administrators to harvest the credentials that granted that write access, which closes the loop: the platform operator's identity was the key to every tenant behind it.

The chain that follows is short and entirely conventional in its parts, which is what makes it worth mapping. When a ministry staff member logged in, the injected script opened a WebSocket to command-and-control, completed a handshake and reported in; a cookie module exfiltrated the page's cookies, and a labelling module read the username straight out of the webmail interface and tagged the new victim with their government email address. Only then did the operators push a lure module, which checked that the address ended in one of nine targeted government domains, that the account was not already compromised, and that the host was Windows, before overlaying a fake Adobe Flash update prompt (Symantec, 2026-08-13). That server-side qualification step is a defensive problem in itself — the malicious behaviour a visiting analyst or a sandbox sees is a cookie read and a WebSocket, because the payload stage never fires for a visitor who fails the filter.

Clicking the prompt downloaded the Antino backdoor, delivered as a fake Adobe Flash or Adobe installer and using the Microsoft Graph API as its command-and-control channel so its traffic sits inside legitimate Microsoft cloud services. Antino also side-loaded the "PDF Viewer" extension into the victim's browser profile, dropped a native-messaging helper and wrote the registry value that enabled it (Symantec, 2026-08-13). The extension is the group's primary implant and requested, in Symantec's words, effectively every dangerous permission the browser exposes — cookies, scripting, debugger access, web-request interception, download monitoring and native messaging across all sites. A background service worker gave the operator a full bridge into the browser API: any Chrome or Firefox function invocable by name, arbitrary JavaScript injected into any page, credentials harvested by hooking login forms, the full cookie jar exfiltrated, live cookie-change events subscribed to so new session tokens are stolen in near real time, plus history, bookmarks, screenshots, clipboard and intercepted traffic. A clipboard module able to swap a copied cryptocurrency address for the attacker's was present and active on victims, but Symantec records that no address-replacement rules were deployed, so the swap was not used during the observed period.

The sandbox escape is the part defenders should take away. To reach the host, the extension talked to a Windows helper registered as a native-messaging host under the misleading name com.microsoft.runedge, which ran operator commands through the Windows command interpreter and returned output to the panel; Antino wrote the enabling registry value under the current user's own hive (Symantec, 2026-08-13). Native messaging is a documented, legitimate browser feature — it is how password managers and document tools talk to their desktop components — and that is precisely why it works here. For at least one victim the bridge carried authenticated traffic to an internal virtualisation-management interface, so browser access became reach into the network behind it.

The group's toolset extends past the browser. Symantec counts 37 builds of a Rust implant the developers call ClientKing, reaching servers and network devices rather than browsers, supporting five command-and-control transports including a custom DNS tunnel, and offering an interactive shell, SOCKS pivoting and the ability to load kernel modules directly from memory; a companion toolkit adds a kernel-module rootkit and a malicious authentication module hooked into su and sudo to steal credentials, across x86-64 servers, ARM64 devices and consumer routers (Symantec, 2026-08-13). For payload delivery the backend created public Google Documents, wrote an obfuscated payload into the body and had implants fetch and execute it, which resolves to Google-owned infrastructure that reputation filtering is unlikely to block, and the group disguised its command-and-control hostnames as typosquats of common web resources such as font services. A scheduled job checked the group's own domains against a public multi-scanner every twelve hours so operators could rotate away from anything flagged.

Scale, in the group's own bookkeeping: the victim database holds more than one million implant check-in rows, more than 580,000 stolen browser cookies, several thousand captured credentials and more than 2,300 exfiltrated email bodies (Symantec, 2026-08-13). Symantec also notes builds configured to beacon through the internal corporate proxy of a major US aerospace and industrial manufacturer, so the tooling is not confined to government estates.

Triage: a native-messaging host registered under HKCU\SOFTWARE\<browser>\NativeMessagingHosts\<reverse-domain-name> is normal on its own — legitimate password managers, document viewers and enterprise agents use this exact mechanism. Three discriminators separate this from that baseline, and they derive from the mechanics the source describes rather than from any indicator: a host name asserting a Microsoft identity while being written per-user under HKCU by a downloaded executable, where a genuine Microsoft browser component arrives through a signed machine-wide installer; the command interpreter appearing with a native-messaging host executable as its parent, a process-lineage pair that legitimate browser-helper traffic does not produce; and an extension whose manifest requests native messaging together with debugger access, web-request interception and all-sites cookie access, a permission combination a document reader has no use for. The extension side-loads into the browser profile rather than arriving from a store, so an extension inventory built only from store IDs will not see it.

Builds on: 2026-05-04/uat-8302-china-nexus-talos-se-european-government-victims