Falcon C2 Framework Uses Browsers and Hidden Panels to Target Governments

Security researchers have uncovered a sophisticated command and control (C2) framework dubbed 'Falcon' (also known as XG or Xiàng Gē) that compromises victims entirely through their web browsers. The framework runs malicious JavaScript on targeted websites—including webmail portals and government web applications—to steal passwords, emails, session cookies, and communications. It also acts as a delivery mechanism for a secondary implant called 'Antino,' which uses Microsoft OneDrive as a covert communication channel. Campaigns observed between March and May 2026 targeted government ministries of foreign affairs, defense, interior, and law enforcement agencies across one Middle Eastern and four Southeast Asian countries, indicating a focus on strategic intelligence gathering. The C2 panels employ clever operational security measures, such as hiding the login form until the F9 key is pressed three consecutive times, to evade automated detection and casual inspection. This browser‑based attack highlights a growing trend where adversaries operate entirely within the victim's browsing context, making traditional network‑level defenses less effective and underscoring the need for enhanced browser security and monitoring.