Falcon C2 Hid in Government Webmail and Stole Logins as Staff Signed In

Spies planted their command-and-control software inside the webmail and web apps that government staff use every day, so simply logging in handed over passwords and mail. Unit 42 says the framework, Falcon (also called XG), runs entirely in the victim’s browser through injected JavaScript, can add a fake “PDF Viewer” extension for full browser control, and delivered a Rust implant called Antino that takes orders through Microsoft OneDrive. Between March and May 2026 it hit ministries of foreign affairs, defense and interior and law enforcement bodies in one Middle Eastern and four Southeast Asian countries.

fonts.tarotfree101[.]top, fonts.chrorne[.]com, robot.avbliud[.]com (Falcon C2)
microsoft-flash[.]com, wps-cn[.]com (payload delivery)

Chrome extension ID mbidcmlcbgbphpoacojjbmfpohcimjji (“PDF Viewer”, version 2026.5.13.1)
flashcenter_pp_ax_install_en.exe (Antino, fake Flash installer)
%LOCALAPPDATA%\Windows GatherOSStateKit\tmp<8 chars>.exe, %TEMP%\SDIAG_<GUID>\result\result.ps1
Hm_lvt_ cookies or local-storage keys on internal portals that don’t use Baidu Analytics

Source article: The XG Files: Falcon C2 Flying Under The (Browser) Radar
Publisher: Palo Alto Networks Unit 42
Published: Nov. 2026
URL: https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/

Executive Summary

Unit 42 documents Falcon, also known as XG (Xiàng Gē), a NodeJS command-and-control framework that runs inside victims’ browsers through injected JavaScript, which Unit 42 assesses with high confidence is a variant of the PeckBirdy script framework Trend Micro reported in January 2026. The operator, whom Unit 42 does not name in this report (its further reading links Talos research on the China-nexus UAT-11587 using Antino and Symantec’s Jewelbug dossier), used Falcon between March and May 2026 against ministries of foreign affairs, defense and interior, a national network-services agency, a telecom, police, intelligence, corrections, justice and military bodies in one Middle Eastern and four Southeast Asian countries. Access came three ways: a script tag injected into the header of 39 Roundcube webmail instances in one country, a custom module on a police web application that harvested usernames and then showed selected users a fake Adobe Flash update that installed the Rust backdoor Antino, and a Chrome extension masquerading as “PDF Viewer” side-loaded in developer mode at a justice department, which beaconed every 3 to 4 minutes for over three weeks while the operator captured internal routing slips and plaintext credentials. The browser implant is obfuscated per session, talks over an AES-protected WebSocket, and with the extension steals credentials, cookies, history, clipboard, Gmail, Discord, Zalo and X messages, intercepts downloads and proxies the operator’s requests through the victim’s session. Antino persists through a diagnostic answer file executed by sdiagnhost.exe and uses an attacker’s OneDrive for command and control. The objective is strategic intelligence collection. Hunt leads, false positive expectations and indicators are detailed below; Unit 42 published no Sigma or YARA rules.

ATT&CK chain: Initial Access → Execution → Persistence → Credential Access → Collection → Command and Control → Exfiltration

Hunt Lead Grid

Falcon Infrastructure and Extension Sweep

Unit 42 published the Falcon C2 domains fonts.tarotfree101[.]top, fonts.chrorne[.]com and robot.avbliud[.]com, the payload delivery domains microsoft-flash[.]com and wps-cn[.]com, the Chrome extension ID mbidcmlcbgbphpoacojjbmfpohcimjji (name “PDF Viewer”, version 2026.5.13.1, description “Portable Document Format”), SHA256 hashes for all files of the Chrome and Firefox extensions, and the Antino sample flashcenter_pp_ax_install_en.exe. Falcon’s victim-facing listener is TCP 443 and its management panel TCP 8080; the 443 default page served a JavaScript Tetris or Snake game to look harmless. The detection logic is a retrospective DNS, proxy and TLS SNI search for the five domains, an inventory query for the extension ID across managed Chrome and Edge profiles, a file hash sweep of extension folders and downloads for the appendix values, and a search for the Antino filename.

Use DNS and proxy logs, browser management reports (Chrome Browser Cloud Management or Intune extension inventory) and EDR file inventory. Sweep back to at least October 2025, when the oldest Antino sample was compiled. Scope first to staff who use webmail and internal case-management portals, then everyone. Fonts.* subdomains are chosen to blend in with font CDNs, so don’t dismiss a hit as a CDN. Any match on a domain or the extension ID should be escalated, and the user’s mail and portal sessions treated as compromised.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence → T1176.001 (Software Extensions: Browser Extensions)

Sources: “The XG Files: Falcon C2 Flying Under The (Browser) Radar”, Palo Alto Networks Unit 42, Nov. 2026, https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/ (source article)

Antino Persistence Artifacts

Antino, delivered by the fake Adobe Flash update, copies itself to %LOCALAPPDATA%\Windows GatherOSStateKit\tmp<8 characters>.exe, tries to copy DllSafeCheck64.dll and slc.dll from its launch directory (remnants of older side-loading builds), and stores a bot ID in a file named id. For persistence it writes a diagnostic answer file to %TEMP%\SDIAG_<GUID>\result\result.ps1 and runs the Microsoft Scripted Diagnostic Native Host, sdiagnhost.exe, which executes the embedded PowerShell and adds Antino to the Windows Registry Run key, so the Run key write comes from a signed Microsoft process. The detection logic is to alert on any executable under a Windows GatherOSStateKit folder, on result.ps1 created under %TEMP%\SDIAG_*\result\ by anything other than a user-launched troubleshooter, and on sdiagnhost.exe or a PowerShell child of it writing to HKCU or HKLM …\CurrentVersion\Run.

Use EDR file, process and registry telemetry, or Sysmon Event IDs 1, 11 and 13. Sweep 180 days, since Antino has existed since October 2025. Scope to all Windows endpoints, with priority on users of the affected web applications. Blocking sdiagnhost.exe is the wrong control because Windows troubleshooters depend on it; detect the Run key write instead. Any Run value pointing into GatherOSStateKit is a confirmed infection and should be escalated, with a check of the user’s OneDrive-bound network traffic.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence → T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder); Execution → T1204.002 (User Execution: Malicious File)

Sources: Unit 42 (above), source article

Injected Script Tags and Hm_lvt_ Keys on Internal Portals

In April 2026 the operator injected a <script> tag into the header of a foreign ministry’s Roundcube webmail portal that loaded a resource named config_r5lfmqe3 from Falcon infrastructure; the server returned an implant obfuscated uniquely for each browser session, a long array of integers with a small decoder loop, and 39 Roundcube instances in that country were affected. On a police web application in May the injected implant ran a module that read the logged-in username, tagged the session, and showed a fake Flash update to selected users at most 10 times, tracked in local storage. The implant stores its session ID in local storage as Hm_lvt_$ and in a cookie Hm_lvt__<session ID>, borrowing Baidu Analytics’ prefix. The detection logic is to file-integrity-monitor the templates and headers of webmail, ticketing and case-management portals and alert on any new script element whose source is outside the approved origin list, to scan served pages for heavily numeric inline JavaScript arrays with a decoder, and to look in browser telemetry or proxy logs for Hm_lvt_ cookies set on internal applications that don’t use Baidu Analytics.

Use web server file integrity monitoring, periodic crawls of portal login pages comparing the rendered DOM to a known-good baseline, Content Security Policy violation reports, and proxy logs of browser requests leaving internal portals for external domains. Sweep back to March 2026. A strict Content Security Policy on portals is the durable control because it blocks unapproved script origins outright. A confirmed injected tag means the web server is compromised as well as every user who logged in since; escalate, reset those users’ passwords and sessions, and investigate how the template was changed.

Hunt Lead Level: 2 (Pro)

ATT&CK: Initial Access → T1189 (Drive-by Compromise); Credential Access, Collection → T1056.003 (Input Capture: Web Portal Capture)

Sources: Unit 42 (above), source article

Developer-Mode “PDF Viewer” Extension With Broad Permissions

At the justice-department victim the Falcon Chrome extension was side-loaded in developer mode, named “PDF Viewer” with a red PDF icon, and requested 40 permissions including access to credentials, cookies and network traffic; it loaded the Falcon implant into a sandboxed offscreen document, injected an analytics-core script into every page to hook network calls, kept up to 500 captured requests and credentials in a cache, and held a WebSocket open from its own context that beaconed every 3 to 4 minutes for more than three weeks. The operator used it to screenshot a routing slip requesting the release of detained persons and to collect plaintext credentials for the internal document system. Unit 42 saw a panel entry for silent Chrome and Firefox install utilities, uploaded April 23 and 25, but did not recover them. The detection logic is to inventory extensions on managed browsers and alert on any unpacked or developer-mode extension, or any extension not from the store, whose manifest requests <all_urls> together with debugger, tabCapture, nativeMessaging or webRequest, and on a browser process holding a long-lived WebSocket to an uncategorized domain from an extension origin.

Use browser management policy reports, EDR file monitoring of the Extensions and Default\Local Extension Settings folders, and proxy logs for WebSocket upgrades. Scope by role: developers legitimately load unpacked extensions, so keep them in a separate allowlisted group and treat any unpacked extension on other users’ machines as suspicious. Blocking developer mode with the DeveloperToolsAvailability or ExtensionInstallBlocklist policies and allowlisting extension IDs is the right control; blocking every “PDF” extension by name is not. A hit should be escalated, the extension preserved for analysis, and every credential saved in that browser rotated.

Hunt Lead Level: 2 (Pro)

ATT&CK: Persistence → T1176.001 (Software Extensions: Browser Extensions); Collection → T1185 (Browser Session Hijacking), T1115 (Clipboard Data); Credential Access → T1555.003 (Credentials from Password Stores: Credentials from Web Browsers), T1539 (Steal Web Session Cookie)

Sources: Unit 42 (above), source article

OneDrive C2 to a Foreign Tenant

Antino carries an XOR-encoded configuration in a .cfg PE section with an attacker’s Microsoft OneDrive tenant ID, client ID, client secret and user ID. It beacons by uploading antino/heartbeat/<Bot ID>.json (hostname, username, campaign remark), polls the OneDrive root for command_req_<Bot ID>_<timestamp>.json files, and supports shell and PowerShell execution, system information, directory listing, Run-key persistence, program execution, file upload and download through OneDrive, and Rhai scripts. The detection logic correlates three signals per endpoint: a process that is not a browser or the OneDrive sync client obtaining tokens from login.microsoftonline.com with the client-credentials flow for a tenant ID that isn’t the organization’s, followed by repeated small uploads to graph.microsoft.com drive paths, at a regular cadence; and, where TLS inspection or Graph audit data exists, file names matching antino/heartbeat/ or command_req_.

Use EDR network telemetry with process attribution, proxy logs with TLS inspection where policy allows, and Entra ID sign-in logs for service principal sign-ins from your network to foreign tenants. Baseline which processes legitimately talk to Microsoft Graph. Blocking OneDrive or Graph outright is the wrong choice; tenant restrictions that only allow your own tenant on managed devices are the durable control and stop this channel. A hit is a confirmed implant: escalate, isolate the host and collect the binary from GatherOSStateKit. The lead generalizes to the many implants that now use cloud storage for C2.

Hunt Lead Level: 3 (Elite)

ATT&CK: Command and Control → T1102.002 (Web Service: Bidirectional Communication)

Sources: Unit 42 (above), source article

Hash Appendix

Falcon Chrome extension (“PDF Viewer”, ID mbidcmlcbgbphpoacojjbmfpohcimjji)

SHA256 values from the source article; MD5 and SHA1 were not published and were not filled from OTX AlienVault or VirusTotal this run. The three icon PNGs are shared with the Firefox build and are weak on their own.

MD5s / SHA1s: (not available) for every file in this section.

SHA256s

3e535d63af8a95221fb517fa1b3e4a0029d3463d8b767443abdff385ee8cb6e9  # analytics-core.js -> page network hook (Chrome and Firefox)
f8b86238e179d88a9979b6f97750a39dda1d07b54d634bc1348fdfb0944a3b92  # background.js (Chrome) -> service worker, data cache
88e8b07bdf294ace0357d35acb7e108c66ba65a2c4ad66351fb8f7806dae0862  # content-script.js (Chrome) -> clipboard, credential theft, hooks
b6a7be724871ed3e81c986b74d62da8911c82a336c4c1857b35f2446b2d49fda  # manifest.json (Chrome) -> "PDF Viewer" manifest, 40 permissions
2ed834d92bfefc9d07a9f1a48f986974ae2a29669029f8163a1f6e8706388fcd  # offscreen.html -> offscreen document
356b96c2267c5f2d8c07693643626e090b6389318b4ffa74699fa1732da5a00c  # offscreen.js (Chrome) -> downloads Falcon implant
32af8413cbd38ce8beb257288cb8e6aa2f9b781d56d0f5272bffbcdc22d999f4  # page.html -> extension page
e2b6b1becdbcc340121e163b5afdfc5437a480ca132248ed5c7c309c45ac3dbb  # page.js -> extension page script
265c2b36060e4b21c25aa86a8bb22d1db5f806117b484774c75c65b5b38222e0  # sandbox.html -> sandboxed execution context
66e9098551a1c0c74077d6cf55570e5d307a4a5ef0b0f2053e139394e61c442d  # sandbox.js (Chrome) -> C2 command executor
3e923f11db08413fca8a3a69d33d8896cfd56309e5179e8604d7fb7110428da2  # twitter-dm.js (Chrome) -> X direct message scraper
065d18fcfeddbd718c054f4b21c3cde5b9291db921d01f343d7ac0d4b41f29ce  # icon128.png -> extension icon
3eab406d841fa22a4b0200c95c1afab068347f835400d5771e8de60aef732016  # icon16.png -> extension icon
5711586125909863b91c1b5ff7cf70ef5d35249d67b11d7a23dc864405cddfe2  # icon48.png -> extension icon

Falcon Firefox extension (files that differ from Chrome)

SHA256 values from the source article; MD5 and SHA1 not available. The other Firefox files share the Chrome hashes above.

2ebe36f1322b77264a33fded81cd4b8817f93362945070bf0bb5845dd27c0575  # background.js (Firefox) -> service worker, data cache
857429faffe0e0747ce299e86eed063ed781b4e403b917ca7e853e89bedf072c  # content-script.js (Firefox) -> clipboard, credential theft, hooks
b33f2e95943e3ff0a72dea1be9fdea03d986bada4def34f6991b3113ec161ad7  # manifest.json (Firefox) -> extension manifest
898656c33effb51e109c548fc213f157f151a870ea64a4601eda74ae75bd3af6  # offscreen.js (Firefox) -> downloads Falcon implant
b3d8ea89b19a87bf2fdd63127086681059f41d67b6e5f8c939f5636a1b2315ce  # sandbox.js (Firefox) -> C2 command executor
24d69139cb2d32598f0f4983876f6320485fac134a66ade59cab76b50b4128f7  # twitter-dm.js (Firefox) -> X direct message scraper

Antino

SHA256 from the source article; MD5 and SHA1 not available.

0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd  # flashcenter_pp_ax_install_en.exe -> Antino backdoor (fake Flash update), copies to %LOCALAPPDATA%\Windows GatherOSStateKit\

References Appendix

• “The XG Files: Falcon C2 Flying Under The (Browser) Radar”, Palo Alto Networks Unit 42, Nov. 2026, https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/ (source article; framework analysis, campaigns, Antino, indicators)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/