Falcon C2 Hid in Government Webmail and Stole Logins as Staff Signed In
Unit 42 says the Falcon browser C2 framework was injected into government webmail and web apps in five countries, added a fake PDF Viewer extension and dropped Antino, a Rust backdoor that uses OneDrive for command and control.