Falcon C2 framework hijacks browsers of Middle East and Southeast Asia government agencies via malicious JavaScript, fake PDF Viewer extensions and Antino implant
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 14/11/2026 12:02; os links antigos trazem para cá.
Fontes: gbhackers.com ↗ securityonline.info ↗ unit42.paloaltonetworks.com ↗
Falcon (also known as XG or Xiàng Gē) is a Node.js browser-based command-and-control (C2) framework that was used between March and May 2026 against government targets in one Middle Eastern country and several Southeast Asian nations. Unit 42 (unit42.paloaltonetworks.com) published the original analysis on 2026-11-11. securityonline.info followed on 2026-11-13 and gbhackers.com on 2026-11-14. Victims are compromised through malicious JavaScript running in the browser and through extensions masquerading as PDF viewers. Targets included ministries of foreign affairs, defense and interior, and law enforcement (unit42.paloaltonetworks.com). Both secondary sources (securityonline.info, gbhackers.com) put the number of Southeast Asian countries at four. gbhackers.com adds that at one Southeast Asian police agency the operators deployed the Antino Rust implant through fake Adobe Flash Player updates. The framework is described as a browser-focused espionage toolset for strategic intelligence collection. securityonline.info links it to variants of the PeckBirdy framework and reports indications of AI-assisted development; Unit 42 does not make this attribution in the text provided.
Detalhes técnicos
- Delivery: JavaScript is injected into government web applications and webmail portals, including Roundcube webmail headers (securityonline.info). Unit 42 notes tailored tradecraft, including social engineering to deliver the malicious extensions. gbhackers.com says the obfuscated implants are delivered via injected script tags.
- Framework: gbhackers.com describes Falcon as a Node.js C2 framework that runs malicious JavaScript inside compromised browsers to intercept credentials, monitor activity and gain authenticated access without a traditional endpoint implant.
- Extensions: Rogue Chrome and Firefox extensions disguised as "PDF Viewer" request broad permissions (securityonline.info; gbhackers.com says one of the extensions is disguised as "PDF Viewer"). Falcon sideloads Chrome extensions to intercept credentials, cookies, browsing data, Discord and Zalo messages, Twitter/X direct messages and clipboard content (unit42.paloaltonetworks.com). securityonline.info also lists emails and manual screenshots among the exfiltrated data.
- Antino implant: Antino uses Microsoft OneDrive as a C2 channel and is delivered through Falcon (unit42.paloaltonetworks.com). securityonline.info describes it as a Rust backdoor. gbhackers.com says it communicates through the Microsoft Graph API and OneDrive, and that at one Southeast Asian police agency it was deployed via fake Adobe Flash Player updates to establish persistence.
- C2 infrastructure: It uses hidden login panels and encrypted WebSocket communications with a negotiated AES session key (unit42.paloaltonetworks.com). gbhackers.com specifies AES-256-CBC with RSA key exchange.
- Persistence: The browser implant persists across sessions using local storage, cookies and extension storage (unit42.paloaltonetworks.com).
- Proxying: Operators can turn the hijacked browser into a proxy server for session hijacking and access to internal resources (unit42.paloaltonetworks.com).
- Evasion: Because Falcon operates inside the browser sandbox, it evades traditional endpoint detection (securityonline.info).
Remediação
Palo Alto Networks says its URL filtering, DNS security, endpoint security and identity management solutions detect and mitigate Falcon techniques (unit42.paloaltonetworks.com). The sources give no further specific guidance and publish no IOCs in the text provided. Defenders should audit browser extensions, especially unexpected "PDF Viewer" extensions with broad permissions, review webmail portals such as Roundcube for injected scripts, and block fake Flash Player update prompts. They should also monitor for unusual Microsoft Graph API and OneDrive traffic. These steps are inferred from the described techniques and are not stated by the sources.
Relatos divergentes
- Geographic scope: Unit 42 (unit42.paloaltonetworks.com) says one Middle Eastern country and "multiple" Southeast Asian nations. securityonline.info and gbhackers.com both say four Southeast Asian nations. The figure of four is now reported by two secondary sources, but the original Unit 42 text provided does not confirm it.
- Antino description and delivery: Unit 42 describes Antino as an implant using OneDrive for C2 that is delivered through Falcon. securityonline.info adds that it is a Rust backdoor, and gbhackers.com (the most recent source) adds the Microsoft Graph API and delivery via fake Adobe Flash Player updates at one police agency. The accounts are largely compatible, but the language and the Flash lure come only from secondary sources.
- Attribution: Only securityonline.info links Falcon to PeckBirdy variants and suggests AI-assisted development. Unit 42, the original and more authoritative technical source, does not state this in the provided text, and gbhackers.com does not mention it, so treat it as unconfirmed.
- Victim agencies: Unit 42 and gbhackers.com list foreign affairs, defense, interior and law enforcement. securityonline.info lists ministries, police, military and justice departments. The latter includes justice, which Unit 42 does not mention.
Linha do tempo
-
Falcon C2 Framework Used to Hijack Browsers and Steal Credentials from Government Agencies in Middle East and Southeast Asia
ler a análise desta fonte ocultar
Between March and May 2026, hackers leveraging the Falcon (also known as XG or Xiàng Gē) Node.js command-and-control framework targeted government entities across one Middle Eastern and four Southeast Asian countries. The campaign focused on foreign affairs, defense, interior, and law enforcement agencies, enabling strategic intelligence collection. Falcon operates by executing malicious JavaScript inside compromised browsers to intercept credentials, monitor activity, and gain authenticated access without a traditional endpoint implant. It uses obfuscated implants delivered via injected script tags, supports encrypted WebSocket C2 channels with AES-256-CBC and RSA key exchange, and offers Chrome and Firefox extensions—one disguised as “PDF Viewer”—with broad permissions to harvest sensitive data and manipulate victim browsers. At one Southeast Asian police agency, operators deployed the Antino Rust implant via fake Adobe Flash Player updates to establish persistence and communicate through Microsoft Graph API and OneDrive. The campaign demonstrates sophisticated multi-stage browser-based espionage with persistent operational visibility in government sectors.
-
Falcon C2 Browser-Based Framework Deploys Antino Implant Targeting Government Portals in Middle East and Southeast Asia
ler a análise desta fonte ocultar
Between March and May 2026, a browser-based JavaScript command-and-control platform called Falcon C2 was used to hijack web browsers of government portals across a Middle Eastern country and four Southeast Asian nations. The threat injects malicious scripts into government web applications and Roundcube webmail headers, compromising agencies including ministries, police, military, and justice departments. The framework deploys rogue Chrome and Firefox extensions disguised as “PDF Viewer” which request broad permissions, and delivers a Rust backdoor named Antino that uses Microsoft OneDrive for command-and-control operations. Falcon C2 evades traditional endpoint detection by operating within the browser sandbox and uses advanced cryptographic handshakes and proxy techniques to execute commands and exfiltrate sensitive data including chat messages, emails, clipboard contents, and manual screenshots. Attribution points to variants related to the PeckBirdy framework, with indications of AI-assisted development.
-
Falcon C2 Framework Uses Malicious JavaScript and Browser Extensions to Compromise Government Targets in Middle East and Southeast Asia
ler a análise desta fonte ocultar
Unit 42 uncovered Falcon (also known as XG or Xiàng Gē), a sophisticated command and control (C2) framework that compromises victims via malicious JavaScript running inside browsers and stealthy browser extensions masquerading as PDF viewers. Falcon operates entirely within the browser context, sideloading Chrome extensions to intercept credentials, cookies, browsing data, Discord and Zalo messages, Twitter/X direct messages, and clipboard content. An implant called Antino uses Microsoft OneDrive as a C2 channel delivered through Falcon. The observed campaigns targeted ministries of foreign affairs, defense, interior, and law enforcement in one Middle Eastern country and multiple Southeast Asian nations from March to May 2026, demonstrating tailored tradecraft such as JavaScript injections into webmail portals and social engineering to deliver malicious extensions. Falcon’s C2 infrastructure utilizes advanced OPSEC, including hidden login panels and encrypted WebSocket communications with a negotiated AES session key. The browser implant persists across sessions using local storage, cookies, and extension storage. Operators can hijack browsers as proxy servers to perform session hijacking and access internal resources. Palo Alto Networks offers multiple layers of detection and mitigation against Falcon’s techniques via URL filtering, DNS security, endpoint security, and identity management solutions. This framework represents an advanced, browser-focused espionage toolset tailored for strategic intelligence collection against government targets.