Jewelbug Stole 2,300 Emails From Government Webmail

No zero day in the mail server. No password guessed, no attachment opened. Somebody with write access to a shared hosting platform added a line to a page template, and every official who loaded their inbox afterwards ran the attacker's JavaScript inside their own authenticated session.

Key Takeaways

• Jewelbug injected a script into the shared template of a webmail platform run by a Middle Eastern state telecommunications provider, firing it across more than 15 government tenants.
• Symantec's recovered victim database holds over 1 million implant check in rows, over 580,000 stolen browser cookies, several thousand credentials and more than 2,300 exfiltrated email bodies.
• The script opened a WebSocket to the attacker's command and control server, stole the page's cookies, then watched cookie change events for fresh session tokens.
• Victims on one of nine targeted government domains got a fake Adobe Flash update prompt that installed the Antino backdoor, which used the Microsoft Graph API as its command channel.
• Symantec attributes Jewelbug's parallel crypto fraud, including hundreds of lookalike OKX and Binance domains, to a Changsha company advertising SEO services.

What Did Jewelbug Actually Compromise?

Jewelbug compromised the hosting platform underneath the webmail, not the individual mailboxes. Per Symantec's writeup, the group gained write access to a shared hosting platform run by a Middle Eastern country's state telecommunications provider and national network services agency, then edited the common page template every tenant inherits.

The payload looked ordinary: a script tag pointing at fonts.chrorne[.]com, a typosquat close enough to a font CDN that a busy administrator would scroll past it. Symantec counted roughly 4,300 distinct source IPs reaching Jewelbug infrastructure across defense, telecom, education and aviation targets in the Middle East, Southeast Asia and South Asia.

How Did One Script Reach 15 Government Tenants?

Multi tenancy did the distribution work. A shared template loads for every tenant, so one write turned into simultaneous code execution inside 15 government organizations that each believed they ran an isolated webmail. The chain, per BleepingComputer and Symantec's Jewelbug dossier:

• Open a WebSocket to the operators' XG-Web panel and hand over the victim's details.
• Exfiltrate the page's cookies, then watch cookie change events for new session tokens.
• Read the signed in username and label the victim with their government email address.
• On a match against nine targeted domains, overlay a fake Adobe Flash update that pulled a second stage executable.

That last step is targeting, not spraying. Only chosen domains got the backdoor. Everyone else was still cookie stripped.

Why Do Stolen Session Cookies Defeat MFA?

A session cookie is proof that authentication already finished, so whoever holds it skips the login entirely. Multi factor authentication guards the moment you sign in, not the token issued afterwards, and that token rides along on every request your browser makes. MITRE tracks this as T1539, Steal Web Session Cookie, noting that a stolen cookie lets an adversary bypass multi factor controls.

NIST reaches the same conclusion defensively. SP 800-63B treats session management as a control separate from authentication, requiring bounded lifetimes and reauthentication, because a session secret is a bearer token: whoever presents it is treated as you.

Same failure mode as the adversary in the middle kits already hitting corporate mail, which we covered when hijacked Outlook inboxes started bypassing MFA. Jewelbug's version is cheaper: no phishing page, no lure email, because the code runs on the real domain the victim typed.

What Can a Malicious Extension See in Your Mail Tab?

Everything you see, plus everything the page holds that you never see. Jewelbug sideloaded an extension called "PDF Viewer" into Chrome and Firefox profiles, requesting close to every dangerous permission a browser exposes: cookies, scripting, debugger access, web request interception, download monitoring and native messaging. Its helper, disguised as com.microsoft.runedge, passed operator commands to the Windows shell.

None of that is exotic. The chrome.cookies API is documented and available to any extension granted it, including cookies flagged HttpOnly that page JavaScript cannot touch. MITRE catalogues the technique as T1176, Software Extensions. An extension with host access to your mail domain reads message bodies after decryption and rendering, once every server side protection has done its job.

Nation state crews are not alone in that seat. A popular developer tool shipped a hidden browsing collector to 1.6 million users this July, broken down in our analysis of ModHeader. Same permission surface, different motive.

What This Means for Your Inbox

You do not control the template your webmail provider serves you. Every habit people are taught, strong password, two factor, do not click strange links, sits upstream of where this attack begins. These victims had logged in successfully.

If you read Gmail, Outlook or any hosted mail in a browser, the architecture is identical, even though those providers are far better defended. Your mail tab holds a session cookie, renders decrypted message bodies, and gives any extension with host permissions a front row seat. What makes provider side compromise devastating is the blast radius: 15 tenants from one file edit.

It is also the third webmail layer email theft in six months, after the decade old Roundcube bug used to read stored mail and the Zimbra campaign that pulled 90 days of messages with no user interaction. The mail client is now a softer target than the mail server.

The Part Most Coverage Buries

Every headline leads with the crossover: a state aligned espionage group running crypto fraud on the side, with hundreds of lookalike OKX and Binance domains tied by Symantec to a Changsha company selling SEO services.

The crossover is novel. It is not the durable lesson. Injecting a script into a page you were not supposed to edit is the core competency of a black hat SEO shop, and Jewelbug pointed that skill at a national webmail platform. The full dossier also documents ClientKing, a Rust implant with 37 builds covering Linux, ARM64 and routers, so the access was meant to last.

What Should You Do Right Now?

• Audit extension permissions, not extension names. Anything that can "read and change data" on your mail domain can read your mail. Google documents how to review and remove Chrome extensions.
• Sign out of every session after a provider incident. A password change does not always kill live sessions. Google's device activity page revokes them, and that is what invalidates a stolen cookie.
• Treat any update prompt inside a mail tab as hostile. Adobe Flash died at the close of 2020, and no plugin, reader or browser ever updates from inside a webmail page. That prompt is the attack.
• Watch for sessions that survive a password reset. Cookie theft is quiet. The tell is a live session from a device you cannot account for.

Looking Ahead

Symantec has published indicators of compromise for the observed activity, which matters most to defenders running the affected platforms. For everyone else the takeaway is narrower: the tab where you read mail is now a target in its own right, independent of your password, your second factor and your provider's servers. A crew part funded by crypto scams got there from one template edit.