MEDIUMApt
Global

China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

·Source: The Hacker News

Updated:

Executive Summary

The China-linked threat actor known as Jewelbug has been observed carrying out cyber espionage operations targeting governments and militaries, while simultaneously engaging in cryptocurrency fraud. "Both missions are administered from a single control panel, XG-Web, a browser-centric remote-access and information-stealing framework that turns a victim's browser into a full remote-control

Analysis

The China-linked threat actor known as Jewelbug has been observed carrying out cyber espionage operations targeting governments and militaries, while simultaneously engaging in cryptocurrency fraud. "Both missions are administered from a single control panel, XG-Web, a browser-centric remote-access and information-stealing framework that turns a victim's browser into a full remote-control
Source Attribution

Originally published by The Hacker News on Aug 14, 2026.

Related Threats

MEDIUMApt

China-Linked APT Uses AI to Optimize Hand-Built Malware

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/china-linked-apt-uses-ai-to-optimize-hand-built-malware-image_small-4-a-32597.jpg" align=right hspace=4><b>SilkParasite Deployed Against Central Asian Governments</b><br>Bitdefender said the China-linked SilkParasite espionage campaign deployed seven modular RATs against Central Asian governments, with coding artifacts indicating

Bank Info Security
MEDIUMApt

'Living Off the Plant' OT Attacks Pose Physical Safety Risk

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/living-off-plant-ot-attacks-pose-physical-safety-risk-image_small-5-a-32591.jpg" align=right hspace=4><b>Beware Abuse of Native OT Functionality, Says Orange Cyberdefense's Ric Derbyshire</b><br>Attackers can employ "living off the plant" tactics to stealthily access and move laterally inside industrial networks, abusing native fu

Bank Info Security
CRITICALApt

CISA Malcolm

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-230-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code.</strong></p> <p>The following versions of CISA Malcolm are affected:</p> <ul> <li>Malcolm <26.0

CVE-2026-55676CVE-2026-63133
CISA Advisories