Hackers breach govt webmail while running parallel crypto fraud

The Jewelbug/Earth Alux group exploited government webmail systems by injecting malicious scripts that harvested session cookies and credentials, allowing persistent access across 15 tenants without needing repeated authentication. The use of a shared command-and-control panel for both espionage and cryptocurrency fraud highlights the sophistication and dual-purpose nature of modern threat actors operating in a hack-for-hire model. Cookie theft is particularly dangerous because it bypasses password protections entirely, including in some MFA configurations, making session token security a critical but often overlooked control. This incident underscores that government webmail systems, often treated as low-risk productivity tools, are high-value targets that require the same hardening as core infrastructure.