Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

Falcon browser C2 hit government agencies in five countries

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Unit 42 says the Falcon Node.js framework stole credentials from government agencies in five countries between March and May 2026.

Palo Alto Networks Unit 42 describes Falcon, also tracked as XG or Xiàng Gē, a Node.js command-and-control framework that runs malicious JavaScript in visitors' browsers. Operators placed the script on webmail portals and government applications, stole passwords, emails, session cookies, and communications, sideloaded Chrome extensions, and delivered an implant called Antino that uses Microsoft OneDrive. Unit 42 says government entities in one Middle Eastern country and four Southeast Asian countries were compromised between March and May 2026, including foreign affairs, defense, interior, and law-enforcement bodies. GBHackers, citing Unit 42, says a fake Adobe Flash Player update delivered Antino, a Rust implant using Microsoft Graph, and that one justice-sector extension stayed active for more than three weeks. Unit 42 assesses with high confidence that Falcon and Trend Micro's PeckBirdy are variants of the same framework.

Key facts
  • Targets included foreign affairs, defense, interior, and law-enforcement bodies in five countries.
  • Admin panel listens on TCP 8080; the victim listener uses port 443.
  • Chrome extension posing as PDF Viewer requests 40 permissions.
  • Antino persists through a Registry Run key as sdiagnhost.exe and tasks via OneDrive.
  • Unit 42 links Falcon to PeckBirdy through shared loaders and Hm_lvt_ identifiers.
  • Management login stays hidden until F9 is pressed three times.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Palo Alto Unit 42Hidden admin login, decoy games, AES-RSA keying, high-confidence PeckBirdy link.
  • GBHackersFake Flash update, Rust implant, 40-permission extension, three-week justice dwell.
Vendors
Palo Alto NetworksMicrosoft
Products
ChromeOneDrive
Malware
FalconAntinoPeckBirdy
Organizations
Unit 42Trend Micro

Coverage

oldest first · one row per article · UTC
  1. · 2d ago Palo Alto Unit 42First report

    Unit 42 says Falcon C2 compromised government sites via browser JavaScript

    The framework stole credentials and cookies, sideloaded Chrome extensions, and delivered the Antino implant over OneDrive.

  2. · 6h ago GBHackers

    Falcon C2 used to hijack browsers at government agencies

    Unit 42 says the Node.js framework, also tracked as XG, hit agencies in five countries from March to May 2026.