Falcon C2 Runs Espionage From Inside the Browser: Injected Roundcube Scripts, a Fake 'PDF Viewer' Extension and the OneDrive-Controlled Antino Implant Hit Five Governments

High · 2026-11-12 · By H.A

Falcon C2 Runs Espionage From Inside the Browser: Injected Roundcube Scripts, a Fake 'PDF Viewer' Extension and the OneDrive-Controlled Antino Implant Hit Five Governments

Researchers detail Falcon, a browser-resident C2 framework related to PeckBirdy that compromised 39 Roundcube portals and government apps in the Middle East and Southeast Asia, sideloaded a 40-permission spy extension and delivered the Rust-based Antino implant via a fake Flash update.

Overview

Security researchers have published a detailed look at Falcon (also called XG, or Xiàng Gē), a Node.js command-and-control framework that runs malicious JavaScript directly inside victims' browsers. Between March and May 2026 the operator planted Falcon scripts on government webmail portals and internal web applications. They used it to steal passwords, emails, session cookies and internal documents. Falcon also sideloaded a malicious "PDF Viewer" browser extension and delivered Antino, a Rust implant that uses Microsoft OneDrive as its command channel.

The researchers assess with high confidence that Falcon and PeckBirdy, a framework reported publicly in January 2026, are variants of the same core codebase. They did not name the operator. Their related references point to China-nexus activity that has also used Antino.

The Campaign

Victims were government bodies in one Middle Eastern country and four Southeast Asian countries. They included ministries of foreign affairs, defence and interior, police and justice agencies, a national network-services agency, a telecom provider and government email systems. The targeting fits strategic intelligence collection.

Timeline

Tradecraft

The Falcon server hides in plain sight. Its panel is a blank page with right-click disabled. The login form appears only after F9 is pressed three times. On port 443 the victim-facing server serves a JavaScript Tetris or Snake game, while the management panel listens on TCP 8080.

The implant blends in with analytics. Each session gets a freshly generated, XOR-encoded script. A 32-character session ID is stored in local storage (Hm_lvt_$), in a cookie named Hm_lvt__<id> that expires in 2099, and in extension storage. The Baidu-Analytics-style names are meant to look like normal tracking traffic. Traffic runs over a TLS WebSocket with a one-minute heartbeat. Payloads are protected with AES-256-CBC keys exchanged under RSA-2048, and an unencrypted "Comet" protocol serves as fallback. The core command is run, which executes arbitrary JavaScript.

The extension is a full browser spy. The Manifest V3 "PDF Viewer" requests 40 permissions with access to all URLs. It can:

Antino copies itself to %LOCALAPPDATA%\Windows GatherOSStateKit\ and abuses sdiagnhost.exe to add a Run key. It writes heartbeats to antino/heartbeat/<BotID>.json in an attacker-controlled OneDrive and picks up command files from the same drive. It supports ten commands, including shell execution, process listing, file upload and download, and running programs.

Researchers also note signs that Falcon was built with AI assistance, including its coding style and inconsistent design choices.

Indicators of Compromise

Falcon C2 domains:

fonts.tarotfree101[.]top
fonts.chrorne[.]com
robot.avbliud[.]com

Payload delivery:

microsoft-flash[.]com
wps-cn[.]com
hxxps[:]//microsoft-flash[.]com/download/Adobe_installer.exe

Malicious Chrome extension ID: mbidcmlcbgbphpoacojjbmfpohcimjji

Antino sample (flashcenter_pp_ax_install_en.exe), SHA-256:

0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd

Extension background.js (Chrome), SHA-256:

f8b86238e179d88a9979b6f97750a39dda1d07b54d634bc1348fdfb0944a3b92

Detection

Recommended Actions

  1. Block the domains and the extension ID above at DNS, proxy and browser-management level.
  2. Enforce an extension allowlist through browser policy and disable developer-mode sideloading on managed devices.
  3. Run file-integrity monitoring on webmail and intranet web roots. Diff Roundcube templates against a clean vendor copy.
  4. If you find a compromise, reset passwords and revoke sessions for every user of the affected portal. Treat stolen cookies as valid until they are invalidated.
  5. Restrict OneDrive and Graph access to approved tenants where your tooling supports tenant restrictions.

Analyst Assessment

Falcon shows that a browser-resident C2 is enough for serious espionage. By compromising the web portal instead of the endpoint, the operator collected credentials from every visitor without writing anything to disk. Antino was deployed only where deeper access was worth the risk. The small campaign footprint, sector focus and shared lineage with PeckBirdy point to a well-resourced, state-aligned actor. Organisations running self-hosted webmail, particularly governments in Southeast Asia and the Middle East, should treat web-root integrity and browser-extension control as first-line defences, not hygiene items.

REEF SENTINEL