Unit 42 uncovers browser-based Falcon C2 targeting governments

Palo Alto Networks Unit 42 has uncovered a browser-based variant of the Falcon C2 framework, also known as XG or Xiang Ge, that targets government portals and delivers a Rust-based implant named Antino. Between March and May 2026, researchers observed attackers compromising dozens of government web resources and Roundcube webmail headers to spy on ministries and police agencies across one Middle Eastern country and four Southeast Asian nations.

The operation utilised rogue Chrome and Firefox extensions titled “PDF Viewer” (version 2026.5.13.1) that request extensive permissions, sideloaded into the victim’s browser, and a system of injected script tags within webmail and portal pages. One Southeast Asian police portal displayed a fake Adobe Flash Player update prompt to trigger Antino deployment.

The framework supports in-browser WebSocket C2 with RSA/AES-256-CBC encryption and can proxy traffic via the browser, intercept downloads, and exfiltrate data from Discord, Zalo, Gmail, and X messages. Antino itself is Rust-based and communicates with a OneDrive folder for command files, using hardcoded OAuth credentials to poll JSON payloads and execute up to 10 commands, including shell execution and file uploads.

The malware decodes a 258-byte configuration from the .cfg section with a two-byte XOR key (0xABCD), copies itself to a local Windows folder, creates Run keys to persist, and uses sdiagnhost.exe for persistence. Defence notes emphasise scrutiny of extensions loaded in developer mode and unusual script tags returning large numeric arrays, alongside monitoring of OneDrive OAuth activity connected to antino/heartbeat paths.