Falcon C2: Controlling Browsers and Stealing Passwords and Cookies Through JavaScript on Compromised Websites

1. Basic Information

• Article Name: The XG Files: Falcon C2 Flying Under The (Browser) Radar
• Publisher: Unit 42
• Publication Date: 2026-11-11
• Collection Date: 2026-11-12T07:30:45+09:00
• Original: Unit 42
• Related Information Sources: None
• Related Malware: Falcon, PeckBirdy, Antino
• Related Threat Groups: None
• Related CVEs: None
• Related Products and Technologies: Google Chrome, Microsoft OneDrive, government webmail portals
• Severity: Critical
• Basis for Severity: Government entities in one Middle Eastern country and four Southeast Asian countries were confirmed to be compromised, with the campaign stealing credentials, sessions, and communication contents from browser contexts and proceeding to distribute endpoint implants.

2. Executive Summary

Unit 42 identified a campaign in which JavaScript embedded in compromised government webmail and web application pages connected visitors' browsers to Falcon C2 and stole passwords, emails, and session cookies. In a separate case involving a judicial organization, a malicious Chrome extension sideloaded in developer mode was used to capture document screenshots and exfiltrate plaintext credentials. The campaign also attempted to distribute Antino, an implant that uses OneDrive for C2.

3. Attack Flow

Falcon C2 via Website Defacement

1. The attacker places malicious JavaScript on a government webmail portal or web application.
2. The visiting browser receives a Falcon implant uniquely obfuscated for that browser session and connects to C2 via a TLS-encrypted WebSocket or Comet.
3. Persistent session IDs are saved to local storage and cookies. Saving to extension storage occurs only if the extension is present.

Path via Malicious Chrome Extension (Potential Alternate Vector)

1. In a judicial organization case, a malicious Chrome extension was sideloaded in developer mode. Who introduced it and through what guidance or actions remains unclear, suggesting an initial intrusion vector distinct from the website defacement path.
2. The extension has capabilities to steal passwords, emails, session cookies, and communications, and document screenshot capture alongside plaintext credential exfiltration was observed in the judicial organization.

Lures Used to Attempt Antino Distribution

1. Falcon attempted to distribute the Antino implant, providing executable files via fake update buttons and similar methods.
2. Execution, persistence, and OneDrive C2 establishment of Antino on the target endpoint have not been confirmed in public reports.

4. Attacker Position and Execution Location

• In the website vector, the attacker is positioned to modify the content of the compromised website. The victim browser receives the implant simply by connecting to the legitimate portal. The extension vector is evaluated as a separate initial intrusion and does not assume website defacement.

5. Visibility for Victims and Administrators

Victim Side

• While legitimate webmails and government sites display normally, unknown extensions or session anomalies may occur within the browser.

Administrator Side

• Appears as JavaScript diffs in legitimate site sources, unknown WebSockets, Hm_lvt_-style storage, extension sideloading, and OneDrive traffic.

6. Success and Failure Conditions

Success Conditions

• Website Vector: The attacker can embed JavaScript into the target site, and the victim visits the compromised site and connects to C2.
• Extension Vector: Sideloading of the malicious extension via developer mode occurs in the victim browser (details of guidance and actions remain unclear).
• Antino Distribution: A Falcon connection is established, and the target user responds to the distribution lure. The lure was displayed only under conditions such as a matching target username, and the number of displays was limited.

Failure Conditions and Mitigations

• Apply CSP and script allowlists to block unexpected script execution (web asset integrity monitoring is a detection control and does not block execution by itself).
• Restrict browser extensions to an enterprise allowlist and limit unknown extensions and developer mode.

7. What Happens Upon Success

• Theft of passwords, emails, session cookies, and communications.
• Continued tracking of browser sessions and persistence via malicious extensions.
• Endpoint compromise and OneDrive C2 if the distribution of the Antino implant results in execution on the target endpoint.

8. Observable Logs

• Email: Email vectors specific to this case have not been published.
• Proxy/SWG/DNS: WebSockets or Comet from legitimate portals to unknown Falcon C2, and non-standard OneDrive client usage.
• Endpoint/EDR: Chrome extension sideloads, Hm_lvt_ keys in extension storage, and processes or files if Antino execution is established.
• Identity/IdP: Abnormal portal session reuse, logins after session cookie revocation, and unexpected geography.
• SaaS/Cloud: Object access on OneDrive for C2 and API calls outside normal user patterns if Antino C2 is established.
• Network: Persistent WebSockets. Heartbeats are generally every minute, but timers reset upon reception, and independent heartbeats may not appear during active periods (absence of per-minute traffic cannot be used as an exclusion criterion).

9. Attack Success Determination

Information Theft or Session Compromise Confirmed

• Public Information: In the case of the judicial organization, document screenshot capture and plaintext credential exfiltration were specifically observed. While the extension has capabilities to steal passwords, emails, session cookies, and communications, theft of all listed information was not confirmed across all targets.
• Confirmation Scope: Government entities in one Middle Eastern country and four Southeast Asian countries observed from March to May 2026. Specific theft observations are from the judicial organization case.

Attack Attempt Observed (Success Unconfirmed)

• Public Information: Falcon was confirmed to present lures intended to distribute Antino, an implant that uses OneDrive for C2. Antino execution, persistence, and establishment of OneDrive C2 on target endpoints remain unconfirmed in public sources.
• Confirmation Scope: The campaign analyzed by Unit 42.

10. Investigation Playbook

• Trigger: Script diffs on legitimate portals, unknown WebSockets, extension sideloading, and session theft.
• Initial Verification: Determine portal defacement time, served JavaScript, C2, affected browser, and session ID.
• Endpoints: Preserve browser profiles, extensions, local storage, cookies, and Antino artifacts.
• Identity and Cloud: Revoke stolen sessions and verify portal, email, and OneDrive access.
• Subsequent Activity: Track email viewing, communication theft, Antino execution, OneDrive C2, and lateral movement.
• Containment: Restore sites, remove malicious scripts, revoke sessions, delete extensions, and isolate endpoints.
• Decision Categories: Separate site visits, browser C2, extension execution, session theft, and Antino compromise.

11. Defense and Detection Ideas

• Single Events: Unknown WebSockets from legitimate portals, extension sideloads, Hm_lvt_-style storage, and non-standard OneDrive clients.
• Time-Series Correlation: Correlate site visits to WebSockets, storage creation, and session reuse for the website path, and sideloads to theft for the extension path. Treat Antino lures as follow-ons to the website path.
• Hunting Perspectives: Search web content hashes, CSP reports, Chrome policies, local storage and cookies, and OneDrive objects.
• Log Shortages: Integrate proxies, IdP sessions, EDR, and web integrity when browser telemetry is insufficient.
• Priority Mitigations: Prioritize portal integrity, extension allowlists, session revocation, CSP, and OneDrive monitoring.

12. Facts / Inference / Hypothesis

Facts

• Unit 42 confirmed government entity compromises in one Middle Eastern country and four Southeast Asian countries between March and May 2026.
• Attackers directly placed malicious JavaScript on government webmail portals and web applications.
• Implants were obfuscated per browser session and communicated with Falcon C2 via TLS WebSockets or Comet.
• Session IDs were stored in local storage and cookies with a Baidu Analytics-like Hm_lvt_ prefix, and in extension storage when the extension was present.
• In the judicial organization case, a malicious Chrome extension was sideloaded in developer mode and used to capture document screenshots and exfiltrate plaintext credentials. Who introduced it and through what guidance remains unclear, indicating a potential initial intrusion vector separate from website defacement.
• Falcon also attempted to distribute Antino, an implant that uses OneDrive for C2. Distribution lures were displayed only under conditions such as a matching target username, and the number of displays was limited. Clicking a button served an executable. Antino execution, persistence, and establishment of OneDrive C2 on target endpoints remain unconfirmed in public reports.
• Unit 42 assessed with high confidence that Falcon and PeckBirdy are variants of the same core framework based on overlaps in cookie naming, cryptographic processing, and architecture.

Inference

• This aligns with strategic information gathering targeting government organizations, but public materials do not indicate attribution to a specific nation or organization.

Hypothesis

• None

13. MITRE ATT&CK Mapping

14. Gaps and Additional Investigation

• The initial vector used to compromise the government websites, the number of affected users, the complete list of C2 domains, operator attribution, and the scope of data acquired from each organization remain undisclosed.

15. Impact on SOCs and Organizations

Because JavaScript runs on the legitimate domains of government and corporate portals, detection via URL reputation alone is difficult. It is necessary to monitor across web integrity, browser extensions, cookies, WebSockets, and OneDrive usage.

16. Summary by Target Audience

• For SOCs: Track unknown WebSockets from legitimate portals, Hm_lvt_-style local storage and cookies, extension sideloads, and OneDrive C2.
• For Administrators: Strengthen web asset integrity, CSP, extension allowlists, session revocation, and OneDrive egress monitoring.
• For Users: Legitimate sites may also be compromised. Report suspicious extensions and re-authentication requests.