Falcon C2 Framework Targets Government Entities with Browser-Based Attacks
Researchers uncover Falcon C2, a sophisticated framework compromising browsers via malicious JavaScript and extensions to steal sensitive data from government organizations.
Palo Alto Networks' Unit 42 researchers have detailed a new threat framework dubbed Falcon, also known as XG or Xiàng Gē, which operates entirely within a victim's browser to compromise sensitive information. This browser-based command and control (C2) framework leverages malicious JavaScript and browser extensions to target government entities, aiming to exfiltrate passwords, emails, session cookies, and communications.
The framework employs a unique operational security measure for its management panel, which initially displays a blank page and disables the right-click context menu. Access to the login interface is hidden behind a specific key sequence (three consecutive F9 presses), preventing automated bots and casual inspection from discovering the panel. Once accessed, the panel features a stylized bird logo and credential input fields.
Falcon is built on NodeJS and operates with two listeners: one on TCP port 8080 for the management panel and another on TCP port 443 for victim-facing interactions. To further blend in, the victim-facing listener has been observed serving classic games like Tetris or Snake as default pages, disguised as legitimate web content.
Technical analysis reveals significant overlap between Falcon and a previously reported framework called PeckBirdy. Both frameworks share near-identical URL structures, payload delivery mechanisms, and communication protocols, including the use of AES for data encryption. A key distinction is Falcon's negotiation of an AES session key encrypted with RSA, whereas PeckBirdy uses a predetermined key. Furthermore, both frameworks store persistent session IDs using a Baidu-mimicking naming convention, employing the Hm_lvt_ prefix in browser cookies or local storage.
When a user visits a compromised website, Falcon generates a uniquely obfuscated implant for that browser session. This implant is constructed from two JavaScript files, victim_common.js and victim.js, which are then XOR encoded and converted into a list of integers for execution. The configuration block within the implant includes the victim's IP address, set by the server during implant generation.
During March to May 2026, Unit 42 observed Falcon campaigns targeting government ministries of foreign affairs, defense, and interior, as well as law enforcement agencies in one Middle Eastern and four Southeast Asian countries. These targets align with strategic intelligence collection objectives, suggesting the threat actor is focused on espionage.
The framework also serves as a delivery mechanism for an implant named Antino, which utilizes Microsoft OneDrive as its C2 channel. This multi-stage approach allows attackers to maintain stealth and operational flexibility, making detection and attribution more challenging.
Palo Alto Networks customers are protected through various products including Advanced WildFire, Advanced URL Filtering, Cortex XDR, and Prisma Browser. Unit 42 offers tailored threat intelligence and incident response services for organizations seeking further assistance or deeper insights into such threats.