Jewelbug APT: Watering-Hole Lure Masquerading as a JPG Photo (Extension Spoofing)

On August 13, 2026, Symantec's Threat Hunter Team published an analysis of Jewelbug — a China-linked hackers-for-hire group whose single control panel (XG-Web, a browser-centric remote-access framework) runs both espionage against government ministries in the Middle East, South Asia, and Southeast Asia, and an industrial-scale cryptocurrency fraud business. Its main implant, the Antino backdoor, is paired with a malicious "PDF Viewer" Chrome/Firefox extension; one watering-hole script alone hit 15+ government webmail tenants in a single Middle Eastern country, and in under three months the victim database logged over 1 million implant check-ins and 580,000+ stolen browser cookies. A hallmark of such lure operations is masquerading: payloads shipped as innocuous media or tools — photos, PDF viewers, government apps — to slip past email gateways and web filters that only check file extensions, and past users who trust the filename. This demo reproduces that pattern at the file level: a bash script (the payload reduced to safely opening the calculator, nothing destructive) renamed with a .jpg extension — the extension says "photo", the content says "script". MetaDefender's FileType Engine ignores the filename, reads the file's magic bytes and structural content, and reports the true type, so the disguised payload is flagged and blocked at the perimeter before it ever reaches an endpoint.