Jewelbug watering-hole script fetch from fonts.chrorne[.]com C2

Duo Tech@duotech

•updated Aug 14, 2026•0•0•4

Detects the exact watering-hole script fetch (fonts.chrorne[.]com /dist/js/*.chunk.js) injected into shared government webmail installations, which opens a WebSocket back to Jewelbug C2 and exfiltrates session cookies and usernames.