Unit 42 uncovers browser based Falcon campaign targeting governments

Unit 42 has tracked Falcon, also known as XG or Xiàng Gē, a browser-native C2 framework that compromises visitors’ web browsers by injecting malicious JavaScript on webmail portals and government apps. The implant runs entirely in the browser, sideloading Chrome extensions to exfiltrate passwords, emails, session cookies and communications, and it has also used Microsoft OneDrive as a C2 channel via a Rust-based implant named Antino.

Campaigns observed between March and May 2026 targeted ministries of foreign affairs, defence and interior, and law enforcement across one Middle Eastern country and four Southeast Asian countries.

Falcon operates with a two-pronged browser extension approach (Chrome and Firefox). The Chrome extension, masquerading as a PDF Viewer, comprises 14 files and requests broad permissions, including access to credentials, cookies and browser network traffic. The extension enables a proxy capability, intercepts and potentially replaces downloads, and uses web page hooks to harvest data and relay it to the C2.

The browser extension can also scrape Gmail and X/Twitter direct messages, and monitor credentials stores, history and downloads. The Falcon implant itself creates a unique, obfuscated script per browser session, uses a TLS WebSocket for command and control, and implements a five-step AES/RSA key exchange for encrypted payloads.

An accompanying Antino component uses OneDrive for heartbeat beacons and command files, with a JSON configuration and 10 available commands, including system info, file lists, and script execution. IOCs include Falcon C2 domains fonts.tarotfree101[.]top, fonts.chrorne[.]com and robot.avbliud[.]com, and the Chrome extension ID mbidcmlcbgbphpoacojjbmfpohcimjji.

The report notes indicators of compromise, and details several campaigns—Roundcube webmail compromise in the Middle East, a username-harvesting and Antino deployment in Southeast Asia, and a Falcon Chrome extension-based persistence campaign in another Southeast Asian country.

For defenders, Unit 42 points to protections across WildFire, URL Filtering, DNS Security, Cortex XDR/XSIAM, Prisma Browser, Idira EPM/IAM, and threat intel services, with emphasis on detecting rogue developer-mode extensions, Baidu-like Hm_lvt cookies, injected script tags, and OneDrive OAuth activity outside the organisation’s tenancy. SOURCE_UNAVAILABLE