Jewelbug Threat Actor Leverages XG-Web for Espionage and Crypto Fraud
China-linked actor conducts dual-use operations against governments and militaries via browser-centric remote-access framework

Key Takeaways
- China-linked threat actor Jewelbug conducts dual-use operations targeting governments/militaries and cryptocurrency fraud.
- Both campaigns are administered from a single control panel, XG-Web.
- XG-Web functions as a browser-centric remote-access and information-stealing framework.
- Operations were reported on August 14, 2026, by The Hacker News.
Related Security News

Former US Air Force Members Sentenced to Prison for Business Email Compromise Scams
Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. The sentencing, reported by BleepingComputer in September 2026, concluded a federal case targeting individuals who abused their military backgrounds to conduct financially motivated email fraud. The attacks spanned multiple years prior to sentencing, though specific victim counts and total financial losses were not detailed in the reporting. The case underscores the legal consequences of using military credentials and training for cyber-enabled fraud.




