Falcon C2 targets government webmail and web applications: review browser compromise signs

Unit 42 analyzed Falcon C2, also known as XG or Xiàng Gē, which was used in campaigns targeting government webmail portals and web applications. The Palo Alto Unit 42 report describes how the framework controls browser implants, steals data, and distributes the Antino implant.

Overview and technical details

Falcon is a NodeJS command-and-control framework that controls JavaScript implants running in victims’ browsers. Unit 42 recorded campaigns from March through May 2026 and assessed with high confidence that Falcon has significant technical similarities to PeckBirdy and that they are variants of the same framework.

Affected systems

The recorded campaigns targeted government agencies in one Middle Eastern country and four Southeast Asian countries. Targets included foreign affairs, defense, interior, and law enforcement agencies. The report identifies government webmail portals and web applications as targets; it does not specify affected product version branches.

Mechanism and impact

Attackers inject malicious JavaScript into government webmail portals and web applications. When a victim visits, the Falcon server generates an obfuscated implant tailored to that browser session. The implant can sideload a malicious Chrome extension and steal passwords, email, session cookies, and communications content.

The implant creates a persistent session identifier in local storage, cookies, and extension memory. Falcon maintains communications over TLS-encrypted WebSocket, sends a heartbeat every minute, and supports the Comet protocol, in which exchanged data is not encrypted. Falcon also distributes Antino, which uses Microsoft OneDrive as a C2 channel.

Remediation and mitigation

1. Prioritize review: Government organizations and operators of webmail portals or web applications should review for browser compromise signs, unusual Chrome extensions, and related C2 activity.
2. Protection products and services named: Palo Alto Networks lists Advanced WildFire; Advanced URL Filtering and Advanced DNS Security; Cortex XDR and XSIAM; Cortex Agentic Endpoint Security; Prisma Browser; Idira Endpoint Privilege Manager (EPM); and Idira Identity and Access Management (IAM).
3. Threat intelligence: Unit 42 Threat Intel Services and Deep and Dark Web Service can provide threat intelligence, facilitate discussions with experts, and help monitor exposure.
4. Suspected compromise: Contact Unit 42 Incident Response if compromise is suspected or an urgent incident occurs.

References

• Palo Alto Unit 42: Falcon C2 browser compromise