An espionage operator spent the spring of 2026 living inside the browsers of government employees. By planting a single line of JavaScript in webmail portals and internal government web applications, the attacker turned every visit into a live, encrypted session it could use to steal passwords, emails and session cookies, researchers at Palo Alto Networks Unit 42 report.
The tool behind it is a command-and-control (C2) framework called Falcon, also known as XG or Xiàng Gē. Unit 42 found it in use against government entities in one Middle Eastern country and four Southeast Asian countries between March and May 2026. Targets included ministries of foreign affairs, defense and the interior, plus police, intelligence, corrections, justice and military bodies, which Unit 42 describes as consistent with strategic intelligence collection.
39 webmail portals carried the same script
In April 2026, Unit 42 found a script tag injected into the header of the Roundcube webmail portal of a Middle Eastern ministry of foreign affairs. It loaded the Falcon implant on every visit, so the operator could intercept credentials as staff signed in. Unit 42 counted 39 affected Roundcube instances in that country and none outside it, a sign of a tightly focused campaign.
At a Southeast Asian police entity in May, the operator first ran a custom module that harvested usernames from an internal web application. It then showed a fake Adobe Flash Player update prompt only to a hard-coded list of chosen users. Clicking it downloaded Antino, a Rust backdoor that takes its orders through Microsoft OneDrive, from microsoft-flash[.]com.
At a Southeast Asian justice entity, access came through a malicious Chrome extension posing as a "PDF Viewer" and sideloaded in developer mode. For more than three weeks it checked in every three to four minutes. Unit 42 watched the operator take a full-page screenshot of an internal routing slip, a request to approve the release of detained persons, while the extension also exfiltrated plaintext credentials for that document system.
A browser extension with 40 permissions
Falcon is written in Node.js and generates a uniquely obfuscated implant for each browser session. The implant talks to its server over a TLS WebSocket, with an extra AES layer whose key is exchanged using RSA. Its companion extensions for Chrome and Firefox request 40 permissions and can:
- turn the victim's browser into a proxy, so the operator can browse internal resources with the victim's own cookies and credentials;
- silently swap legitimate downloads, such as ChromeSetup.exe, for the operator's payload while keeping the original filename;
- hook web traffic to capture Discord messages and Zalo chat databases, and pull Gmail messages with attachments;
- scrape X/Twitter direct messages and rewrite clipboard contents.
The operator's panel hides its login form until F9 is pressed three times, and the victim-facing server displays a harmless JavaScript game of Tetris or Snake. Unit 42 assesses with high confidence that Falcon is a variant of the same core framework as PeckBirdy, which Trend Micro documented in January 2026, citing near-identical URL structures and delivery, and a shared Baidu-style Hm_lvt_ cookie prefix. The researchers also say the code shows signs of AI-assisted development.
Unit 42 does not name the actor behind the campaigns. Its report points readers to Symantec's dossier on Jewelbug and its XG-Web panel and to Cisco Talos's research on UAT-11587 and the Antino backdoor as further reading.
Check portal templates and developer-mode extensions
Unit 42 advises defenders to hunt for:
- browser extensions installed in developer mode that mimic utilities such as PDF viewers and request broad permissions like <all_urls>, debugger, tabCapture, nativeMessaging or webRequest;
- Hm_lvt_ cookies or local-storage keys on internal or government applications where Baidu Analytics has no reason to appear;
- new script tags in webmail, ticketing or case-management templates that load heavily numeric JavaScript from unfamiliar external domains;
- OAuth activity to OneDrive tenants outside your own, especially repeated small JSON writes to paths such as antino/heartbeat/ or antino/antino_upload/.
Indicators from the report: payload delivery domains microsoft-flash[.]com and wps-cn[.]com; malicious extension ID mbidcmlcbgbphpoacojjbmfpohcimjji; Antino sample SHA-256 0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd (flashcenter_pp_ax_install_en.exe).
For the webmail victims, nothing ever had to be installed on their computers. The browser tab was the intrusion, and the portal they trusted most was the delivery system.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.