Jewelbug Uses Public Google Docs as Malware Command-and-Control Delivery Channel

A China-linked threat group tracked as Jewelbug has turned public Google Docs into a resilient command-and-control delivery channel, embedding freshly obfuscated malware payloads in documents that victim implants retrieve and execute.

The technique allows malicious traffic to resolve through Google-owned infrastructure, helping the operators blend into legitimate web activity and potentially evade reputation-based filtering.

Jewelbug, also tracked as Earth Alux, REF7707 and CL-STA-0049, operates a dual-purpose ecosystem combining government-focused cyber espionage with a commercial cryptocurrency-fraud operation.

Investigators found that both missions rely on shared infrastructure, overlapping tradecraft and a unified operator platform called XG-Web.

XG-Web is a browser-centric remote-access and information-stealing framework built with a React front end, Node.js backend and MySQL victim database.

The platform allows operators to manage campaigns, collect stolen data, issue commands and deliver payloads across compromised browsers, Windows systems, Linux servers and network devices.

Despite being described internally as a “penetration-testing platform,” its modules explicitly support browser hijacking, credential theft and man-in-the-middle activity.

The Google Docs mechanism appears designed to make payload delivery harder to block.

When an operator activates a campaign, the XG-Web backend creates a publicly accessible Google Document and inserts an obfuscated payload into its body.

Implants fetch the document, decode the content and execute the resulting code. Each payload is XOR-encoded with a randomized key, ensuring that two downloads are not identical.

Researchers identified 13 live documents associated with active campaigns.

The group also uses typosquatted domains masquerading as trusted resources, including Google Fonts-like infrastructure.

This pattern featured prominently in a large watering-hole attack against a Middle Eastern government webmail environment.

Symantec Researchers said that, Jewelbug allegedly compromised a shared hosting platform operated by a state telecommunications provider, then inserted a single malicious script into the common webmail template.

The compromise exposed more than 15 government webmail tenants simultaneously.

When users accessed their webmail, the injected script established a WebSocket connection with Jewelbug’s command-and-control infrastructure, harvested browser cookies and identified victims by their government email addresses.

Jewelbug Uses Public Google Docs

Selected users were presented with a fake Adobe Flash update prompt that downloaded the Antino Windows backdoor.

Antino uses the Microsoft Graph API for command-and-control, concealing communications within legitimate cloud-service traffic.

The malware was delivered through politically themed HTML Application downloaders and fake Adobe installers, including lures impersonating events associated with the Center for Strategic and International Studies.

Once installed, Antino could also sideload Jewelbug’s malicious browser extension, “PDF Viewer.”

The extension supports both Chrome and Firefox and requests extensive permissions, including cookie access, scripting, debugger control, web-request interception and native messaging.

It can steal credentials, browser history, bookmarks, screenshots, clipboard contents and live session cookies.

A Windows native-messaging helper disguised as a Microsoft Edge component, com.microsoft.runedge, enables operators to escape browser restrictions and execute shell commands on the host.

Jewelbug’s infrastructure also includes ClientKing, a Rust-based implant targeting Linux servers, routers and network devices.

ClientKing supports DNS tunneling, interactive shells, SOCKS proxying and in-memory kernel-module loading.

Some builds were configured to communicate through the internal proxy of a major U.S. aerospace and industrial manufacturer, indicating the group’s interest in network-level persistence and lateral movement.

The operation’s scale is notable. Jewelbug’s victim database reportedly contained more than one million implant check-ins, over 580,000 stolen browser cookies, thousands of captured credentials and more than 2,300 exfiltrated email bodies in under three months.

The campaign illustrates how trusted SaaS platforms, browser extensions and shared web infrastructure can be combined into a highly scalable espionage delivery model.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now