Falcon C2 framework hijacks browsers of Middle East and Southeast Asia government agencies via malicious JavaScript, fake PDF Viewer extensions and Antino implant
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 13/11/2026 12:04; os links antigos trazem para cá.
Falcon (also known as XG or Xiàng Gē) is a browser-based command-and-control (C2) framework that was used between March and May 2026 against government targets in one Middle Eastern country and several Southeast Asian nations. Unit 42 (unit42.paloaltonetworks.com) published the original analysis on 2026-11-11, and securityonline.info followed on 2026-11-13. Victims are compromised through malicious JavaScript running in the browser and through extensions masquerading as PDF viewers. Targets included ministries of foreign affairs, defense and interior, and law enforcement (unit42.paloaltonetworks.com). The framework is described as a browser-focused espionage toolset for strategic intelligence collection. securityonline.info links it to variants of the PeckBirdy framework and reports indications of AI-assisted development; Unit 42 does not make this attribution in the text provided.
Detalhes técnicos
- Delivery: JavaScript is injected into government web applications and webmail portals, including Roundcube webmail headers (securityonline.info). Unit 42 notes tailored tradecraft, including social engineering to deliver the malicious extensions.
- Extensions: Rogue Chrome and Firefox extensions disguised as "PDF Viewer" request broad permissions (securityonline.info). Falcon sideloads Chrome extensions to intercept credentials, cookies, browsing data, Discord and Zalo messages, Twitter/X direct messages and clipboard content (unit42.paloaltonetworks.com). securityonline.info also lists emails and manual screenshots among the exfiltrated data.
- Antino implant: Antino uses Microsoft OneDrive as a C2 channel and is delivered through Falcon (unit42.paloaltonetworks.com). securityonline.info describes it as a Rust backdoor.
- C2 infrastructure: It uses hidden login panels and encrypted WebSocket communications with a negotiated AES session key (unit42.paloaltonetworks.com).
- Persistence: The browser implant persists across sessions using local storage, cookies and extension storage (unit42.paloaltonetworks.com).
- Proxying: Operators can turn the hijacked browser into a proxy server for session hijacking and access to internal resources (unit42.paloaltonetworks.com).
- Evasion: Because Falcon operates inside the browser sandbox, it evades traditional endpoint detection (securityonline.info).
Remediação
Palo Alto Networks says its URL filtering, DNS security, endpoint security and identity management solutions detect and mitigate Falcon techniques (unit42.paloaltonetworks.com). The sources give no further specific guidance and publish no IOCs in the text provided. Defenders should audit browser extensions, especially unexpected "PDF Viewer" extensions with broad permissions, and review webmail portals such as Roundcube for injected scripts. These steps are inferred from the described techniques and are not stated by the sources.
Relatos divergentes
- Geographic scope: Unit 42 (unit42.paloaltonetworks.com) says one Middle Eastern country and "multiple" Southeast Asian nations. securityonline.info says four Southeast Asian nations. The count of four is not confirmed by the original Unit 42 text.
- Antino description: Unit 42 describes Antino as an implant using OneDrive for C2. securityonline.info adds that it is a Rust backdoor. The two accounts are compatible, but the language detail comes only from the secondary source.
- Attribution: Only securityonline.info links Falcon to PeckBirdy variants and suggests AI-assisted development. Unit 42, the original and more authoritative technical source, does not state this in the provided text, so treat it as unconfirmed.
- Victim agencies: Unit 42 lists foreign affairs, defense, interior and law enforcement. securityonline.info lists ministries, police, military and justice departments. The latter includes justice, which Unit 42 does not mention.
Linha do tempo
-
Falcon C2 Browser-Based Framework Deploys Antino Implant Targeting Government Portals in Middle East and Southeast Asia
ler a análise desta fonte ocultar
Between March and May 2026, a browser-based JavaScript command-and-control platform called Falcon C2 was used to hijack web browsers of government portals across a Middle Eastern country and four Southeast Asian nations. The threat injects malicious scripts into government web applications and Roundcube webmail headers, compromising agencies including ministries, police, military, and justice departments. The framework deploys rogue Chrome and Firefox extensions disguised as “PDF Viewer” which request broad permissions, and delivers a Rust backdoor named Antino that uses Microsoft OneDrive for command-and-control operations. Falcon C2 evades traditional endpoint detection by operating within the browser sandbox and uses advanced cryptographic handshakes and proxy techniques to execute commands and exfiltrate sensitive data including chat messages, emails, clipboard contents, and manual screenshots. Attribution points to variants related to the PeckBirdy framework, with indications of AI-assisted development.
-
Falcon C2 Framework Uses Malicious JavaScript and Browser Extensions to Compromise Government Targets in Middle East and Southeast Asia
ler a análise desta fonte ocultar
Unit 42 uncovered Falcon (also known as XG or Xiàng Gē), a sophisticated command and control (C2) framework that compromises victims via malicious JavaScript running inside browsers and stealthy browser extensions masquerading as PDF viewers. Falcon operates entirely within the browser context, sideloading Chrome extensions to intercept credentials, cookies, browsing data, Discord and Zalo messages, Twitter/X direct messages, and clipboard content. An implant called Antino uses Microsoft OneDrive as a C2 channel delivered through Falcon. The observed campaigns targeted ministries of foreign affairs, defense, interior, and law enforcement in one Middle Eastern country and multiple Southeast Asian nations from March to May 2026, demonstrating tailored tradecraft such as JavaScript injections into webmail portals and social engineering to deliver malicious extensions. Falcon’s C2 infrastructure utilizes advanced OPSEC, including hidden login panels and encrypted WebSocket communications with a negotiated AES session key. The browser implant persists across sessions using local storage, cookies, and extension storage. Operators can hijack browsers as proxy servers to perform session hijacking and access internal resources. Palo Alto Networks offers multiple layers of detection and mitigation against Falcon’s techniques via URL filtering, DNS security, endpoint security, and identity management solutions. This framework represents an advanced, browser-focused espionage toolset tailored for strategic intelligence collection against government targets.