The XG Files: Falcon C2 Flying Under The (Browser) Radar
Falcon C2 framework targets governments with malicious browser scripts and extensions.
Unit 42 has identified Falcon C2, a browser-based command and control framework that compromises victims' browsers using malicious JavaScript. Attackers have used Falcon to steal passwords, emails, session cookies, and communications, and also delivered an implant called Antino which uses Microsoft OneDrive as a C2 channel. The campaigns observed between March and May 2026 targeted government entities in one Middle Eastern and four Southeast Asian countries.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Antino?
Get an email when a new story names Antino, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonFalcon C2 demonstrates how attackers can weaponize the browser itself as a command-and-control implant, bypassing traditional network-layer defenses by operating entirely within trusted browser processes. By injecting malicious JavaScript, attackers exfiltrated passwords, session cookies, and communications without triggering endpoint or perimeter alerts. The secondary implant Antino further evaded detection by tunneling C2 traffic through Microsoft OneDrive, a trusted cloud service unlikely to be blocked. This matters because organizations that rely solely on network-based controls have no visibility into browser-layer compromise, leaving credential theft and session hijacking undetected for weeks or months.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Antino