Hackers Use Falcon C2 Framework to Hijack Browsers and Steal Credentials From Government Agencies

Hackers deployed Falcon, a Node.js command-and-control framework tracked as XG or Xiàng Gē, against government entities in one Middle Eastern country and four Southeast Asian countries between March and May 2026.

Unit 42 identified targets spanning foreign affairs, defense, interior, and law enforcement organizations, indicating strategic intelligence collection.

The framework executes malicious JavaScript inside compromised browsers, enabling credential interception, surveillance, and authenticated access to government applications without immediately requiring a conventional endpoint implant.

Hackers Use Falcon C2 Framework

Falcon conceals its management interface behind a blank page with right-click functionality disabled; pressing F9 three consecutive times reveals the login form.

Its administrative panel listens on TCP port 8080, while the victim-facing listener uses port 443 and displays JavaScript Tetris or Snake games as camouflage.

Operators inject script tags into compromised webmail portals and government applications. Each session receives an implant obfuscated through single-byte XOR encoding. Shared loaders, URL structures, and Baidu-style Hm_lvt_ identifiers connect Falcon to PeckBirdy.

The implant establishes a TLS-protected WebSocket C2 connection and negotiates AES-256-CBC encryption. A 2048-bit RSA public key protects the generated 32-byte AES key and initialization vector during exchange.

Operators execute JavaScript through eval and retrieve information through framework APIs. The connection persists while the infected tab remains open, with minute-based heartbeats maintaining idle sessions.

However, encryption is not universal: Falcon supports an unencrypted Comet fallback, and unavailable Web Crypto functionality triggers weaker encoding alternatives.

For expanded access, Falcon provides Chrome and Firefox extensions, with the Chrome package masquerading as “PDF Viewer.” Its Manifest V3 configuration requests 40 permissions, including access to all websites.

Unit42 stated that background components collect credentials, cookies, history, and downloads, while analytics-core.js hooks fetch and XMLHttpRequest operations.

Its reverse-proxy capabilities let attackers send requests through victims’ browsers using existing credentials and session cookies. Additional modules replace downloads, manipulate clipboard contents, and collect Gmail, Discord, Zalo, and X communications.

At a Southeast Asian police entity, operators harvested usernames before presenting selected users with fraudulent Adobe Flash Player update prompts.

These delivered Antino, a Rust implant with compilation timestamps dating to October 2025. Antino decodes configuration from its PE .cfg section using XOR key 0xABCD and establishes Registry Run persistence through sdiagnhost.exe.

Its Microsoft Graph API communications use OneDrive for heartbeats, tasking, and transfers. Ten commands support shell execution, PowerShell, file operations, and Rhai scripts.

Defenders should investigate unauthorized developer-mode extensions, excessive permissions, injected webmail scripts, and unexpected Hm_lvt_ storage artifacts.

Hunting should correlate browser WebSocket activity with foreign OneDrive tenant authentication and antino/ directory writes. One justice-sector extension remained active for over three weeks, stealing plaintext credentials and capturing internal document-system screenshots, demonstrating sustained operational visibility.

IOCs

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team