Browser-Based Falcon C2 Framework Targets Government Portals and Deploys Antino Implant
Do Son 
Falcon proxy capability overview | Image: Unit 42
At a Glance
| Malware Family | Falcon C2 framework (also known as XG or Xiang Ge; related to PeckBirdy), malicious Chrome and Firefox “PDF Viewer” extensions, and the Rust-based Antino implant |
| Threat Actor | Unattributed espionage operator (confirmed high-confidence tool overlap with PeckBirdy; suspected AI-assisted code development) |
| Target / Victims | Government entities across 1 Middle Eastern country (39 Roundcube webmail instances) and 4 Southeast Asian countries, including ministries of foreign affairs, defense, interior, justice, and police |
| Delivery Vector | Injected script tags in compromised webmail and government portals, sideloaded browser extensions, and fake Adobe Flash Player update prompts |
| Key Capabilities | In-browser WebSocket C2 with RSA/AES-256-CBC encryption, browser proxy routing, download interception, Zalo/Discord/Gmail/X chat theft, and OneDrive-based C2 via Antino |
TL;DR
Palo Alto Networks Unit 42 uncovered a JavaScript command-and-control platform called the Falcon C2 framework that hijacks web browsers visiting government portals. Between March and May 2026, attackers used the browser-based Falcon C2 framework to spy on ministries and police agencies across one Middle Eastern country and four Southeast Asian nations. In addition to sideloading rogue Chrome extensions, the framework delivers a Rust backdoor named Antino that routes commands through Microsoft OneDrive.
Delivery and Attribution
Between March and May 2026, attackers injected malicious script tags directly into government web applications and Roundcube webmail headers. In April 2026, researchers counted 39 compromised Roundcube webmail instances within a single Middle Eastern country, including its Ministry of Foreign Affairs. Separate campaigns hit intelligence, police, military, and justice agencies across four Southeast Asian countries. In one Southeast Asian police portal, the script harvested usernames from the page DOM and displayed a fake Adobe Flash Player update prompt up to 10 times to selected accounts to deliver the Antino executable.
Confirmed Versus Suspected Attribution
While confirmed attribution does not name a specific state-sponsored group, Unit 42 confirmed with high confidence that Falcon (also called XG or Xiang Ge) and the PeckBirdy framework documented by Trend Micro in January 2026 are variants of the same core toolset. According to the Unit 42 research report, “Based on these extensive technical overlaps, we assess with high confidence that Falcon and PeckBirdy represent variants of the same core framework.” Both tools share near-identical URL paths and store victim session IDs using the Baidu Analytics prefix Hm_lvt_. Meanwhile, suspected attribution regarding the framework’s creation points to AI-assisted development, evidenced by inconsistent JavaScript status checks and variable naming styles.
Infection Chain
The Node.js-based Falcon server runs a management listener on TCP port 8080 and a victim listener on TCP port 443. To hide from scanners, the victim port displays a playable JavaScript game of Tetris or Snake, while the admin page stays blank, blocks right-clicking, and reveals its login prompt only after an operator presses the F9 key three times in a row. When a user visits an infected portal, the server combines two template files, XOR-encodes the script into a large integer array with a one-byte key, and serves a unique payload per session. The script then saves a 32-character session ID inside local storage, a cookie expiring in 2099, and an extension cache.
Rogue PDF Viewer Extension and Antino Persistence
For deeper access, operators deploy Chrome and Firefox extensions disguised as “PDF Viewer” (version 2026.5.13.1) that request 40 permissions and full host access. On startup, the background worker creates an offscreen document and an iframe sandbox that fetches and runs the Falcon implant via eval, while a content script injects analytics-core.js into every visited webpage.
When victims run the secondary Antino Rust implant, the binary decodes a 258-byte configuration from its .cfg PE section using the two-byte XOR key 0xABCD. Next, Antino copies itself to a local Windows GatherOSStateKit folder, writes a diagnostic answer file to a temporary SDIAG directory, and launches the native Windows utility sdiagnhost.exe to add a Registry Run key without triggering standard alerts.
Command-and-Control and Data-Exfiltration Behavior
The browser implant keeps a TLS WebSocket connection open while the tab remains active, performing a five-step cryptographic handshake. Specifically, the server sends a 2048-bit RSA public key, and the browser uses the native Web Crypto API to generate and return an RSA-encrypted 256-bit AES key and 16-byte IV for AES-256-CBC communication. Through custom APIs, the implant executes arbitrary JavaScript and sends operator alerts via Telegram.
When the PDF Viewer extension is active, the browser-based Falcon C2 framework turns the victim’s browser into an authenticated web proxy that reuses stored cookies and credentials to reach internal corporate pages. As the researchers noted, “This technique enables an operator to achieve code execution on the victim’s system by intercepting a legitimate download and replacing it with the operator’s payload.” The extension also hooks fetch and XMLHttpRequest calls to siphon Discord messages, Zalo chat databases, Gmail inboxes, clipboard events, and X direct messages across six languages. In one Southeast Asian justice department, operators even took manual full-page screenshots of sensitive prisoner-release routing slips. Meanwhile, the Antino implant uses hardcoded OAuth credentials to poll a Microsoft OneDrive folder for JSON command files, supporting 10 commands including shell execution, file uploads, and embedded Rhai scripts.
Defense and Detection Guidance
Because the Falcon C2 framework operates inside the browser sandbox, traditional endpoint sensors often miss its activity. Defenders should audit enterprise browsers for extensions sideloaded in developer mode, especially utilities named PDF Viewer requesting broad host permissions. Web administrators should also inspect internal webmail and application templates for unauthorized script tags returning large numeric arrays, and check for unexpected Hm_lvt_ cookies on non-Chinese government portals. Finally, network teams should monitor firewall logs for Microsoft OneDrive OAuth traffic connecting to external tenants or writing JSON files to antino/heartbeat/ paths.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
