Unit 42 identifies Falcon C2 browser framework targeting government entities

Palo Alto Networks Unit 42 researchers identified Falcon C2 as a browser command and control framework that compromised government entities in one Middle Eastern country and four Southeast Asian countries between March and May 2026. The framework is also known as XG or Xiàng Gē. The framework hijacks browsers by injecting malicious JavaScript, with an actor placing malicious JavaScript directly inside government web applications and webmail portals to compromise visitors, and Unit 42 described the operation as confirmed and active work aimed at government targets. Law enforcement, interior, defense, and foreign affairs ministries were selected as targets in alignment with intelligence-gathering aims, according to Unit 42.

In one Middle Eastern country, the operation focused on the foreign affairs ministry, breaking into Roundcube webmail instances to capture credentials and session cookies. According to Unit 42, operators injected scripts into government webmail portals and spread malicious browser extensions that pose as PDF viewers.

Unit 42 and detections.ai said Falcon delivered an implant named Antino that relies on Microsoft OneDrive for command and control. The Antino implant is written in Rust and uses Microsoft OneDrive as its command and control channel. The modular design of Falcon let attackers gather internal usernames and extract direct messages from social platforms such as X formerly Twitter.

Falcon carries two browser extensions, one built for Firefox and one for Chrome, and they function identically while working with the implant. The Chrome extension pretends to be a PDF reader called PDF Viewer. The extension is made up of 14 files and asks for 40 permissions that reach credentials, cookies and browser network traffic.

Unit 42 said it does not know how the operator deploys the browser extensions, and judges that the operator probably tricks victims into installing them. A tool held by the operator can silently install Firefox and Chrome plugins, though Unit 42 lacks a sample of the utility needed for deeper study.

The NodeJS framework opens two listeners, one on TCP port 8080 and another on TCP port 443. One listener handles the management panel interface, while the other listener serves victims. The listener that faces victims shows a JavaScript-based Tetris game meant to blend in. A separate listener instance ran a game of Snake.

The management panels load a blank screen that carries no visible branding or login screen, putting off casual inspection. Three presses of the F9 key in sequence are needed to reveal the hidden login form. Pressing any other key resets the counter. Once activated the screen shows the Falcon brand, a stylized bird logo, and boxes to enter credentials.

The implant creates a lasting 32-character lower case alphanumeric session identifier for each victim. It stores the identifier in browser local storage with key Hm_lvt_$. It also uses a cookie named Hm_lvt followed by the session ID that expires in the year 2099. The identifier is kept in the Falcon extension storage cache, and the storageApi dictionary appears only on browsers with the Falcon extension installed.

While the affected browser tab stays open, the implant opens a WebSocket connection encrypted with TLS. It transmits a heartbeat once each minute to maintain the connection, and standalone heartbeats are not needed because incoming messages restart the implant’s internal timer. Data the payload sends to the C2 server goes unencrypted when Comet is used, though the WebSocket feature supports AES encryption layered over TLS transport.

When the browser’s Web Crypto API is present the implant encrypts exchanged data with AES, and if the API is missing it falls back to URL-encoding and Base64 instead. The server supplies a 2048-bit RSA public key to shield a 256-bit AES session key during the key exchange. Session keys encrypt payload contents through AES-256-CBC for all later network transmissions.

When it registers, the implant sends the server the tab’s current URL and domain. It also collects client IP addresses and browser User-Agent strings. Operators can run any JavaScript through evaluation calls using the run command. The implant provides four main command APIs for stealing data, alerting an operator or marking a session.

Falcon runs only inside the browser context. Operators used it to add malicious Chrome extensions and take passwords, e-mails, session cookies and communications. An operator can route traffic through a victim’s browser as a proxy, which allows session hijacking and reaching internal network resources.

Operator criteria control which file downloads the extension catches and replaces. One sample rule swaps executable downloads from google.com and dl.google.com for an operator-controlled URL while keeping the original filename. To intercept requests and responses, the extension installs hooks for window.fetch and the XMLHttpRequest.open and XMLHttpRequest.send methods. The background worker caches intercepted data in FIFO order with a limit of 500 requests.

It grabs Discord chat messages and friend lists along with Zalo chat message databases. Zalo works like WhatsApp and is popular in Vietnam as a chat application. It can pull Gmail e-mail data covering the date, receiver, sender, subject, message body and any attachments. It monitors clipboard activity and can swap copied content such as account numbers or cryptocurrency wallet addresses under rules set by the operator.

Management panels take tool uploads from operators, who can password-protect them. The panel displays two uploaded tools.

No CVE applies to the campaign, since it abuses legitimate browser extensibility features rather than a flaw vendors can patch. Browser-based compromise defeats traditional perimeter and endpoint assumptions, with no suspicious executable available to block and no unusual port to firewall. Persistence lives in the browser profile, which most EDR policies and application whitelisting tools treat as benign.

Ignoring browser extension tracking, child process inspection, and searches for spawned script interpreters opens a major security gap. Consent from users is bypassed when managed browsers have extensions force-installed through registry changes to the ExtensionInstallForcelist. Session hijacking by stealing cookies with extensions skips multifactor authentication entirely.

Falcon C2 illustrates a wider trend in which threat actors drop conventional malware delivery for browser-native implants that get around EDR and perimeter defenses. Browser-based C2 frameworks are increasing because they avoid endpoint detection tools that most organizations rely on. Attackers who exploit the browser layer can remain unseen for months while government and enterprise workflows shift to SaaS and web applications.

Visibility at the network layer and egress enforcement matter more than ever. Using cloud services such as OneDrive for command and control makes network-level detection harder by mixing malicious traffic with legitimate business communications.

Unit 42 assessed with high confidence that Falcon and PeckBirdy are versions of one shared core framework, based on broad technical overlaps. The researchers noted that Trend Micro’s January 2026 write-up framed PeckBirdy as a flexible script framework meant to misuse built-in system tools.