[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9qQXw39dBu432jqdJGYICl9P5BFMVw9Uxj9KtmUKpAA":3},{"article":4,"iocs":50,"watch_terms":53,"solutions":54,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"a4dc3eed-069b-47b1-89d2-216d2f5b8a04","The XG Files: Falcon C2 Flying Under The (Browser) Radar","the-xg-files-falcon-c2-flying-under-the-browser-radar-9ad4b0","We uncover Falcon C2, a browser-based threat framework targeting governments via malicious scripts, extensions, and the Antino implant. The post The XG Files: Falcon C2 Flying Under The (Browser) Radar appeared first on Unit 42.","Unit 42 has identified Falcon C2, a browser-based command and control framework that compromises victims' browsers using malicious JavaScript. Attackers have used Falcon to steal passwords, emails, session cookies, and communications, and also delivered an implant called Antino which uses Microsoft OneDrive as a C2 channel. The campaigns observed between March and May 2026 targeted government entities in one Middle Eastern and four Southeast Asian countries.","Falcon C2 framework targets governments with malicious browser scripts and extensions.","https:\u002F\u002Funit42.paloaltonetworks.com\u002Ffalcon-c2-browser-compromise\u002F","https:\u002F\u002Funit42.paloaltonetworks.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F06_Malware_Category_1920x900-8.jpg","2026-11-11T15:00:23+00:00","2026-11-11T16:00:19.68996+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"Falcon","threat_actor",{"name":21,"type":19},"XG",{"name":23,"type":19},"Xiàng Gē",{"name":25,"type":26},"Antino","product",{"name":28,"type":29},"NodeJS","technology",{"name":31,"type":29},"JavaScript","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":36,"value":25,"context":52},"Implant delivered by Falcon C2",[25],{"controls":55,"vendors":143},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":86,"name":87,"problem":88,"products":89},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"slug":115,"name":116,"problem":117,"products":118},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",[144],{"slug":145,"name":146,"logo_path":147,"roles":148},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[149],"reported_by",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":160},"browser-based-c2-framework-steals-credentials-and-hijacks-sessions-via-malicious-javascript","Browser-Based C2 Framework Steals Credentials and Hijacks Sessions via Malicious JavaScript","Falcon C2 demonstrates how attackers can weaponize the browser itself as a command-and-control implant, bypassing traditional network-layer defenses by operating entirely within trusted browser processes. By injecting malicious JavaScript, attackers exfiltrated passwords, session cookies, and communications without triggering endpoint or perimeter alerts. The secondary implant Antino further evaded detection by tunneling C2 traffic through Microsoft OneDrive, a trusted cloud service unlikely to be blocked. This matters because organizations that rely solely on network-based controls have no visibility into browser-layer compromise, leaving credential theft and session hijacking undetected for weeks or months.",[155,156,157,158,159],"MITRE ATT&CK T1185: Browser Session Hijacking","MITRE ATT&CK T1102: Web Service","NIST SP 800-53 SI-4: System Monitoring","NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events","NIS2 Article 21(2)(j)",{"NIS2 Article 21(2)(j)":161,"MITRE ATT&CK T1102: Web Service":162,"NIST SP 800-53 SI-4: System Monitoring":163,"MITRE ATT&CK T1185: Browser Session Hijacking":164,"NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events":165},"MFA and secured communications are required under this provision; phishing-resistant MFA would have limited attackers' ability to leverage stolen passwords and session cookies for sustained access.","The Antino implant used Microsoft OneDrive as a C2 channel, which is exactly the technique of abusing legitimate external web services to blend malicious traffic with normal cloud activity.","SI-4 requires monitoring for unauthorized or anomalous activity; detecting JavaScript-based C2 and cloud-tunneled implants requires endpoint and network monitoring capable of inspecting browser-layer behavior.","Falcon C2 directly implements browser session hijacking by stealing session cookies and credentials from within compromised browser contexts.","Outbound C2 traffic routed through OneDrive would have been detectable had network monitoring been in place to flag unusual cloud-service communication patterns from government endpoints."]