Malware · 1 day ago
Unit 42 identified Falcon, a browser-based framework used to compromise government entities in five countries between March and May 2026. The campaign targeted visitors to government applications and webmail portals in one Middle Eastern and four Southeast Asian countries, collecting passwords, emails, session cookies and other communications.
Falcon puts malicious JavaScript into those sites, so visiting a familiar page makes the browser run attacker-controlled code. The framework can then sideload malicious Chrome extensions and deliver Antino, a separate implant that uses Microsoft OneDrive as its command-and-control channel.
If staff rely on these portals, removing Antino or cleaning an endpoint alone would not undo stolen credentials or session cookies; access to webmail and government applications may remain exposed through the browser and identity layer.
1 source covering this story
The XG Files: Falcon C2 Flying Under The (Browser) Radar
We uncover Falcon C2, a browser-based threat framework targeting governments via malicious scripts, extensions, and the Antino implant.
Part of the PlainSec briefing for 2026-11-12