Jewelbug APT Hijacks Government Webmail in Global Espionage Campaign Targeting Session Cookies

Executive Summary

As of August 24, 2026, Encrygma intelligence has tracked a significant escalation in operations by the state-sponsored actor known as Jewelbug (also identified as APT-J). This group has successfully infiltrated government networks across Asia and the Middle East, focusing on the exfiltration of browser cookies to bypass multi-factor authentication (MFA). This campaign follows a broader trend where state-sponsored cyberattacks from N. Korea, China, and Russia have risen 7.5% in the first half of 2026, signaling a more aggressive posture by nation-state adversaries.

Threat Analysis

The Jewelbug campaign represents a shift in state-sponsored TTPs (Tactics, Techniques, and Procedures) toward session hijacking. By targeting government webmail, the actors gain access to sensitive diplomatic communications and internal directories. According to recent reports, Jewelbug compromised government webmail to steal browser cookies and spy on officials, effectively rendering traditional MFA protections obsolete. This activity coincides with other high-stakes operations, such as recent reports that Russian-linked hackers accessed a Polish power plant OT network through a private APN, demonstrating a multi-pronged approach to critical infrastructure and government espionage.

Technical Details

The primary vector for Jewelbug involves the deployment of a custom toolkit designed to intercept and exfiltrate session tokens. The group utilizes a 'browser-in-the-middle' technique, where victims are lured to legitimate-looking but malicious login portals. Once the user authenticates, the actor captures the session cookie, allowing them to impersonate the user without needing the MFA token. This technique is similar to the view-based exploits seen in Russian state-supported campaigns targeting Zimbra Collaboration Suite, which exfiltrate email communications and Global Address Lists (GAL) upon the mere viewing of a malicious email. Jewelbug has also been observed using Go-based custom backdoors to maintain persistence within compromised government environments.

Attribution Assessment

Encrygma assesses with high confidence that Jewelbug is a nation-state actor, likely operating in alignment with Asian strategic interests. The scale of the operation—spanning at least 37 countries—and the specific targeting of diplomatic and military entities suggest a well-resourced state sponsor. The group's focus on long-term espionage rather than immediate financial gain distinguishes it from cybercriminal entities, though there is a growing overlap in the tools used by state actors and sophisticated ransomware groups.

Implications

The success of the Jewelbug campaign highlights a critical vulnerability in current identity management frameworks. The ability to bypass MFA through cookie theft means that even 'secure' government accounts are at risk. This could lead to the exposure of classified strategic plans, sensitive personnel data, and the potential for lateral movement into more secure segments of national infrastructure, including operational technology (OT) systems.

Recommendations

Organizations are strongly advised to move toward phishing-resistant MFA, such as FIDO2-compliant hardware keys, which are less susceptible to session hijacking. Additionally, security teams should implement strict session management policies, including shorter session timeouts and IP-binding for sensitive webmail access. Continuous monitoring for anomalous login locations and the use of EDR solutions to detect unauthorized browser-level modifications are essential to mitigating the Jewelbug threat. Finally, organizations should adopt zero-trust frameworks that safeguard cloud infrastructure and AI integration platforms against increasingly sophisticated state-sponsored reconnaissance.