The XG Files: Falcon C2 Flying Under The (Browser) Radar

Unit 42 identified Falcon (aka XG or Xiàng Gē), a browser-based command and control (C2) framework that compromises victims by injecting malicious JavaScript into webmail portals and government websites. The framework enables attackers to steal session cookies, passwords, emails, and other sensitive data, and to deploy a malicious browser extension for persistent access. Falcon has been used in targeted campaigns against government entities in one Middle Eastern and four Southeast Asian countries, with objectives aligned to strategic intelligence collection. A secondary Rust-based implant named Antino, which uses Microsoft OneDrive for C2, was also deployed in some attacks.

AI-extracted · verify before operational use