Falcon C2 Framework Exposes Browser-Based Espionage Operations

Between March and May 2026, Unit 42 identified compromises of government entities in one Middle Eastern country and four Southeast Asian countries using a browser-resident command-and-control framework called Falcon (also XG or Xiàng Gē).

What Falcon is and how it operates inside browsers

Unit 42 describes Falcon as a NodeJS-based command-and-control (C2) framework that runs entirely in the browser by delivering malicious JavaScript into legitimate sites. The framework’s victim-facing listener operates on TCP port 443 and commonly serves innocuous-looking pages — for example, a JavaScript Tetris or Snake game — to blend into normal web browsing. Management panels run on TCP port 8080 and are designed to remain semi-hidden, revealing a login form only after the F9 key is pressed three times to frustrate casual inspection.

Falcon-generated implants combine two files — victim_common.js (configuration) and victim.js (communication and command execution) — then obfuscate the result by XOR-encoding each character into a long integer array. The resulting script decodes itself in the victim’s browser tab and maintains a long-lived TLS-encrypted WebSocket session, sending heartbeat messages every minute.

Technical mechanics: session IDs, encryption, and persistence inside the browser

The implant creates a persistent 32-character lowercase alphanumeric session ID per victim and uses a three-tier storage strategy designed to survive restarts: a local-storage key named Hm_lvt_$, a cookie named Hm_lvt__<session ID> set with a 2099 expiry, and storage within the Falcon extension cache if present. Unit 42 points out the Baidu-analytics-like naming (Hm_lvt_) as a deliberate blending mechanism.

Falcon negotiates a 256-bit AES session key via a five-step exchange: the server offers a 2048-bit RSA public key; the implant generates AES key and IV (using Web Crypto if available); the implant encrypts these with the RSA key and transmits them; subsequent traffic is encrypted with AES-256-CBC over the TLS WebSocket. When Web Crypto is unavailable the implant falls back to URL-encoding and Base64; a non-encrypted Comet fallback also exists.

Browser extensions, proxying, and high-fidelity data collection

Falcon includes Chrome and Firefox extensions that work with the implant. The Chrome extension masquerades as a "PDF Viewer" and requests an exceptionally broad permission set that grants full browser control, including access to credentials, cookies, and network traffic. Unit 42 recovered the Chrome extension ID mbidcmlcbgbphpoacojjbmfpohcimjji and the extension’s file list and SHA-256 hashes.

Key extension capabilities described by Unit 42 include:

• Using the victim’s browser as an outbound proxy so an operator can issue requests that use the victim’s session cookies and credential store, and receive Base64-encoded responses over the implant WebSocket.
• Intercepting and replacing file downloads according to operator-defined domain and extension rules, cancelling originals and inserting malicious payloads while preserving the original filename and download appearance.
• Network hooking that overrides window.fetch and XMLHttpRequest to capture request and response bodies (JSON and text), caching up to 500 requests for operator exfiltration.
• Specialized modules to scrape Gmail, Discord, X/Twitter direct messages, Zalo chat databases, clipboard contents, and browser-stored credentials, attachments, history and downloads.

Antino: a Rust implant using Microsoft OneDrive as C2

Unit 42 identified Antino — a Rust-based implant dating to at least Oct. 6, 2025 — which Falcon served as a delivery mechanism in some campaigns. Antino stores a XOR-encoded JSON configuration in its .cfg PE section containing Microsoft OneDrive credentials and a campaign remark. For persistence it copies itself under %LOCALAPPDATA%\\Windows GatherOSStateKit and uses the Microsoft Scripted Diagnostic Native Host (sdiagnhost.exe) with a crafted diagnostic answer file to add itself to the Windows Registry Run key.

Antino uses OneDrive for C2 by uploading heartbeat JSON to antino/heartbeat/<Bot ID>.json and polling for files named command_req_<Bot ID>_<timestamp>.json. Unit 42 extracted the Antino sample hash 0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd (flashcenter_pp_ax_install_en.exe) and documented Antino’s command set, including support for executing embedded Rhai scripts.

Campaigns: Roundcube webmail and targeted operations in Southeast Asia

Unit 42 mapped distinct campaigns that used Falcon against government targets. Notable findings:

• Middle Eastern country — In April 2026, attackers injected a <script> tag into a Ministry of Foreign Affairs Roundcube webmail portal that loaded an obfuscated Falcon implant (resource config_r5lfmqe3). Unit 42 observed 39 Roundcube instances affected and assessed with high confidence that the script executed on each visit, enabling credential interception and inbox access.
• Southeast Asian country A (police entity) — In May 2026, an implant harvested usernames from a page element (leftusername) and, for selected accounts, displayed a fake Adobe Flash update that delivered the Antino payload from microsoft-flash[.]com/download/Adobe_installer.exe.
• Southeast Asian country B (justice entity) — Operators sideloaded the Falcon Chrome extension in developer mode to maintain persistent access; Unit 42 recorded multi-week check-ins and instances where the operator captured screenshots and plaintext credentials from internal document systems.

What this means for technologists, procurement leaders, and end users

Technologists and security teams should monitor for indicators Unit 42 highlights: browser extensions installed in developer mode that request broad permissions; Hm_lvt_ cookies or local-storage keys on internal or government apps where Baidu Analytics is not expected; unfamiliar <script> tags in webmail or case-management portals that return numeric JavaScript arrays; and unusual OAuth activity to Microsoft OneDrive tenants with small JSON writes under antino/heartbeat/ or antino/antino_upload/.

Procurement and IT leaders should note the specific IoCs and artifacts Unit 42 published — Falcon C2 domains (fonts.tarotfree101[.]top, fonts.chrorne[.]com, robot.avbliud[.]com), the Chrome extension ID mbidcmlcbgbphpoacojjbmfpohcimjji, and the Antino sample hash — and consider those when validating software and third-party telemetry.

End users should be wary of unexpected browser install prompts, fake update dialogs, and developer-mode extension installs; Unit 42 documents social-engineered flows that deliver payloads via otherwise familiar-looking pages and extension packages.

Conclusion

Unit 42’s analysis shows an operator using a browser-centric toolchain to evade traditional endpoint detections, extend access via malicious extensions, and hand off a Rust-based implant that uses OneDrive for C2. The combination — obfuscated session-unique implants, persistent session storage that mimics analytics telemetry, broad extension privileges for proxying and intercepting traffic, and OneDrive beaconing — creates an operational pattern organizations can search for using the concrete indicators and behaviors Unit 42 published.

Read the full Unit 42 report: https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/