Threat actorhigh
Falcon C2 used to hijack browsers at government agencies
Original title: Hackers Use Falcon C2 Framework to Hijack Browsers and Steal Credentials From Government Agencies
AI summary · x-ai/grok-4.7Summaries by Vani AI
Unit 42 says the Node.js framework, also tracked as XG, hit agencies in five countries from March to May 2026.
Unit 42 reports that Falcon, a Node.js command-and-control framework also tracked as XG, was used against government entities in one Middle Eastern country and four Southeast Asian countries between March and May 2026. Operators injected JavaScript into compromised webmail and government applications, then used browser extensions to steal credentials, cookies, and communications and to proxy requests through victims' sessions. A fake Adobe Flash Player update delivered Antino, a Rust implant that uses Microsoft Graph and OneDrive. One justice-sector extension remained active for more than three weeks.
Unconfirmed: Unit 42 does not name the five countries or attribute Falcon operators to a known group.
Key facts
- Targets included foreign affairs, defense, interior, and law enforcement organizations.
- The admin panel listens on TCP port 8080; the victim listener uses port 443.
- The Chrome extension, posing as PDF Viewer, requests 40 permissions.
- Antino persists through a Registry Run key as sdiagnhost.exe and tasks via OneDrive.
- Shared loaders and Hm_lvt_ identifiers connect Falcon to PeckBirdy.
Security assessment · AI, from the article
Impact: Stolen credentials, cookies, and access to government applications
What to do
- 1.Investigate unauthorized developer-mode extensions, injected webmail scripts, and Hm_lvt_ artifacts.
- 2.Correlate browser WebSocket activity with foreign OneDrive logins and antino directory writes.
- ATT&CK
- T1176 Browser ExtensionsT1185 Browser Session HijackingT1539 Steal Web Session CookieT1102.002 Web Service: Bidirectional CommunicationT1547.001 Registry Run Keys / Startup Folder
- Organizations
- Unit 42
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | avbliud.com | lcon C2 domain fonts.chrorne[.]com — Falcon C2 domain robot.avbliud[.]com — Chrome extension ID mbidcmlcbgbphpoacojjbmfpohcimjji — |
| domain | chrorne.com | C2 domain fonts.tarotfree101[.]top — Falcon C2 domain fonts.chrorne[.]com — Falcon C2 domain robot.avbliud[.]com — Chrome extension |
| domain | microsoft-flash.com | 6ade59cab76b50b4128f7 twitter-dm.js Payload delivery domain microsoft-flash[.]com — Payload delivery domain wps-cn[.]com — Antino sample 0c |
| domain | tarotfree101.top | ry Indicator / SHA-256 Hash Filename Falcon C2 domain fonts.tarotfree101[.]top — Falcon C2 domain fonts.chrorne[.]com — Falcon C2 domain |
| domain | wps-cn.com | very domain microsoft-flash[.]com — Payload delivery domain wps-cn[.]com — Antino sample 0c39264337a1186b2e765e24073399cbdcba11830 |
| sha256 | 065d18fcfeddbd718c054f4b21c3cde5b9291db921d01f343d7ac0d4b41f29ce | 6351fb8f7806dae0862 content-script.js Chrome extension file 065d18fcfeddbd718c054f4b21c3cde5b9291db921d01f343d7ac0d4b41f29ce icon128.png Chrome extension file 3eab406d841fa22a4b0200c95 |
| sha256 | 0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd | ]com — Payload delivery domain wps-cn[.]com — Antino sample 0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd flashcenter_pp_ax_install_en.exe Note: IP addresses and dom |
| sha256 | 24d69139cb2d32598f0f4983876f6320485fac134a66ade59cab76b50b4128f7 | 7b6e5f8c939f5636a1b2315ce sandbox.js Firefox extension file 24d69139cb2d32598f0f4983876f6320485fac134a66ade59cab76b50b4128f7 twitter-dm.js Payload delivery domain microsoft-flash[.]com |
| sha256 | 265c2b36060e4b21c25aa86a8bb22d1db5f806117b484774c75c65b5b38222e0 | 480ca132248ed5c7c309c45ac3dbb page.js Chrome extension file 265c2b36060e4b21c25aa86a8bb22d1db5f806117b484774c75c65b5b38222e0 sandbox.html Chrome extension file 66e9098551a1c0c74077d6cf |
| sha256 | 2ebe36f1322b77264a33fded81cd4b8817f93362945070bf0bb5845dd27c0575 | 43abdff385ee8cb6e9 analytics-core.js Firefox extension file 2ebe36f1322b77264a33fded81cd4b8817f93362945070bf0bb5845dd27c0575 background.js Firefox extension file 857429faffe0e0747ce299 |
| sha256 | 2ed834d92bfefc9d07a9f1a48f986974ae2a29669029f8163a1f6e8706388fcd | c4c1857b35f2446b2d49fda manifest.json Chrome extension file 2ed834d92bfefc9d07a9f1a48f986974ae2a29669029f8163a1f6e8706388fcd offscreen.html Chrome extension file 356b96c2267c5f2d8c0769 |
| sha256 | 32af8413cbd38ce8beb257288cb8e6aa2f9b781d56d0f5272bffbcdc22d999f4 | 8b4ffa74699fa1732da5a00c offscreen.js Chrome extension file 32af8413cbd38ce8beb257288cb8e6aa2f9b781d56d0f5272bffbcdc22d999f4 page.html Chrome extension file e2b6b1becdbcc340121e163b5af |
| sha256 | 356b96c2267c5f2d8c07693643626e090b6389318b4ffa74699fa1732da5a00c | 29f8163a1f6e8706388fcd offscreen.html Chrome extension file 356b96c2267c5f2d8c07693643626e090b6389318b4ffa74699fa1732da5a00c offscreen.js Chrome extension file 32af8413cbd38ce8beb25728 |
| sha256 | 3e535d63af8a95221fb517fa1b3e4a0029d3463d8b767443abdff385ee8cb6e9 | ID mbidcmlcbgbphpoacojjbmfpohcimjji — Chrome extension file 3e535d63af8a95221fb517fa1b3e4a0029d3463d8b767443abdff385ee8cb6e9 analytics-core.js Chrome extension file f8b86238e179d88a997 |
| sha256 | 3e923f11db08413fca8a3a69d33d8896cfd56309e5179e8604d7fb7110428da2 | 5ef0b0f2053e139394e61c442d sandbox.js Chrome extension file 3e923f11db08413fca8a3a69d33d8896cfd56309e5179e8604d7fb7110428da2 twitter-dm.js Firefox extension file 3e535d63af8a95221fb517 |
| sha256 | 3eab406d841fa22a4b0200c95c1afab068347f835400d5771e8de60aef732016 | 921d01f343d7ac0d4b41f29ce icon128.png Chrome extension file 3eab406d841fa22a4b0200c95c1afab068347f835400d5771e8de60aef732016 icon16.png Chrome extension file 5711586125909863b91c1b5ff7 |
| sha256 | 5711586125909863b91c1b5ff7cf70ef5d35249d67b11d7a23dc864405cddfe2 | 835400d5771e8de60aef732016 icon16.png Chrome extension file 5711586125909863b91c1b5ff7cf70ef5d35249d67b11d7a23dc864405cddfe2 icon48.png Chrome extension file b6a7be724871ed3e81c986b74d |
| sha256 | 66e9098551a1c0c74077d6cf55570e5d307a4a5ef0b0f2053e139394e61c442d | 7b484774c75c65b5b38222e0 sandbox.html Chrome extension file 66e9098551a1c0c74077d6cf55570e5d307a4a5ef0b0f2053e139394e61c442d sandbox.js Chrome extension file 3e923f11db08413fca8a3a69d3 |
| sha256 | 857429faffe0e0747ce299e86eed063ed781b4e403b917ca7e853e89bedf072c | 5070bf0bb5845dd27c0575 background.js Firefox extension file 857429faffe0e0747ce299e86eed063ed781b4e403b917ca7e853e89bedf072c content-script.js Firefox extension file 065d18fcfeddbd718c |
| sha256 | 88e8b07bdf294ace0357d35acb7e108c66ba65a2c4ad66351fb8f7806dae0862 | d634bc1348fdfb0944a3b92 background.js Chrome extension file 88e8b07bdf294ace0357d35acb7e108c66ba65a2c4ad66351fb8f7806dae0862 content-script.js Chrome extension file 065d18fcfeddbd718c0 |
| sha256 | 898656c33effb51e109c548fc213f157f151a870ea64a4601eda74ae75bd3af6 | 9f8163a1f6e8706388fcd offscreen.html Firefox extension file 898656c33effb51e109c548fc213f157f151a870ea64a4601eda74ae75bd3af6 offscreen.js Firefox extension file 32af8413cbd38ce8beb2572 |
| sha256 | b33f2e95943e3ff0a72dea1be9fdea03d986bada4def34f6991b3113ec161ad7 | d67b11d7a23dc864405cddfe2 icon48.png Firefox extension file b33f2e95943e3ff0a72dea1be9fdea03d986bada4def34f6991b3113ec161ad7 manifest.json Firefox extension file 2ed834d92bfefc9d07a9f1 |
| sha256 | b3d8ea89b19a87bf2fdd63127086681059f41d67b6e5f8c939f5636a1b2315ce | b484774c75c65b5b38222e0 sandbox.html Firefox extension file b3d8ea89b19a87bf2fdd63127086681059f41d67b6e5f8c939f5636a1b2315ce sandbox.js Firefox extension file 24d69139cb2d32598f0f49838 |
| sha256 | b6a7be724871ed3e81c986b74d62da8911c82a336c4c1857b35f2446b2d49fda | 9d67b11d7a23dc864405cddfe2 icon48.png Chrome extension file b6a7be724871ed3e81c986b74d62da8911c82a336c4c1857b35f2446b2d49fda manifest.json Chrome extension file 2ed834d92bfefc9d07a9f1a |
| sha256 | e2b6b1becdbcc340121e163b5afdfc5437a480ca132248ed5c7c309c45ac3dbb | 81d56d0f5272bffbcdc22d999f4 page.html Chrome extension file e2b6b1becdbcc340121e163b5afdfc5437a480ca132248ed5c7c309c45ac3dbb page.js Chrome extension file 265c2b36060e4b21c25aa86a8bb22 |
| sha256 | f8b86238e179d88a9979b6f97750a39dda1d07b54d634bc1348fdfb0944a3b92 | 443abdff385ee8cb6e9 analytics-core.js Chrome extension file f8b86238e179d88a9979b6f97750a39dda1d07b54d634bc1348fdfb0944a3b92 background.js Chrome extension file 88e8b07bdf294ace0357d35 |
From the original article
3 min read at gbhackers.com
Hackers deployed Falcon, a Node. js command-and-control framework tracked as XG or Xiàng Gē, against government entities in one Middle Eastern country and four Southeast Asian countries between March and May 2026. Unit 42 identified targets spanning foreign affairs, defense, interior, and law enforcement organizations, indicating strategic intelligence collection.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.