China-Linked Threat Actor Jewelbug Leverages XG-Web for Espionage and Crypto Fraud

China-linked threat actor Jewelbug employs the XG-Web framework for dual-purpose operations, combining government espionage with cryptocurrency fraud. The platform enables remote browser control, credential theft, and network infiltration through sophisticated implants and obfuscation techniques.

The China-linked threat actor known as Jewelbug has been observed carrying out cyber espionage operations targeting governments and militaries, while simultaneously engaging in cryptocurrency fraud.

"Both missions are administered from a single control panel, XG-Web, a browser-centric remote-access and information-stealing framework that turns a victim's browser into a full remote-control

Read original article