[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6og7aqOWbexmCibAjsH9NN2H7YCXmrbPX7tIVFJnLho":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"fd8514bc-f471-4150-9926-02a8b48e0b32","browser-based-c2-framework-steals-credentials-and-hijacks-sessions-via-malicious-javascript","a4dc3eed-069b-47b1-89d2-216d2f5b8a04","Browser-Based C2 Framework Steals Credentials and Hijacks Sessions via Malicious JavaScript","Falcon C2 demonstrates how attackers can weaponize the browser itself as a command-and-control implant, bypassing traditional network-layer defenses by operating entirely within trusted browser processes. By injecting malicious JavaScript, attackers exfiltrated passwords, session cookies, and communications without triggering endpoint or perimeter alerts. The secondary implant Antino further evaded detection by tunneling C2 traffic through Microsoft OneDrive, a trusted cloud service unlikely to be blocked. This matters because organizations that rely solely on network-based controls have no visibility into browser-layer compromise, leaving credential theft and session hijacking undetected for weeks or months.","**Immediate actions:**\n- Deploy browser isolation or endpoint detection tools capable of inspecting and blocking malicious JavaScript execution in-browser.\n- Enforce session cookie protections (HttpOnly, Secure, SameSite flags) and short session lifetimes to limit the value of stolen cookies.\n- Block or proxy outbound traffic to known cloud storage services (e.g., OneDrive) from non-standard processes to disrupt C2 channels.\n\n**Detection measures:**\n- Implement Content Security Policy (CSP) headers across all internal and public-facing web applications to restrict unauthorized script execution.\n- Enable logging of browser process network connections at the endpoint level and alert on unusual outbound traffic to cloud file-sharing services.\n- Monitor for bulk credential access patterns or simultaneous session usage from geographically disparate locations.\n\n**Long-term improvements:**\n- Adopt phishing-resistant MFA (e.g., FIDO2\u002Fpasskeys) so stolen passwords and session cookies cannot be replayed for persistent access.\n- Conduct regular threat-hunt exercises specifically targeting browser-based implant indicators such as anomalous JavaScript injection or unexpected OneDrive API calls.\n- Establish a zero-trust browsing policy that restricts browser access to only approved web destinations for high-risk roles such as government users.",[12,13,14,15,16],"MITRE ATT&CK T1185: Browser Session Hijacking","MITRE ATT&CK T1102: Web Service","NIST SP 800-53 SI-4: System Monitoring","NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events","NIS2 Article 21(2)(j)",{"NIS2 Article 21(2)(j)":18,"MITRE ATT&CK T1102: Web Service":19,"NIST SP 800-53 SI-4: System Monitoring":20,"MITRE ATT&CK T1185: Browser Session Hijacking":21,"NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events":22},"MFA and secured communications are required under this provision; phishing-resistant MFA would have limited attackers' ability to leverage stolen passwords and session cookies for sustained access.","The Antino implant used Microsoft OneDrive as a C2 channel, which is exactly the technique of abusing legitimate external web services to blend malicious traffic with normal cloud activity.","SI-4 requires monitoring for unauthorized or anomalous activity; detecting JavaScript-based C2 and cloud-tunneled implants requires endpoint and network monitoring capable of inspecting browser-layer behavior.","Falcon C2 directly implements browser session hijacking by stealing session cookies and credentials from within compromised browser contexts.","Outbound C2 traffic routed through OneDrive would have been detectable had network monitoring been in place to flag unusual cloud-service communication patterns from government endpoints.","published","2026-11-11T16:21:19.964112+00:00","2026-11-11T16:21:19.94+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Funit42.paloaltonetworks.com\u002Ffalcon-c2-browser-compromise\u002F","the-xg-files-falcon-c2-flying-under-the-browser-radar-9ad4b0","The XG Files: Falcon C2 Flying Under The (Browser) Radar",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",[],[45,49,53],{"slug":46,"name":47,"problem":48},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":50,"name":51,"problem":52},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":54,"name":55,"problem":56},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]