🔍 Falcon C2 turns browsers into intrusion platforms Between March and May 2026, Falcon C2, a NodeJS browser compromise framework also tracked as XG/XIng Gē, was used against government and law enforcement in one Middle East and four Southeast Asian countries. The operators injected malicious JavaScript into government portals and e-mail, then used Chrome and Firefox "PDF Viewer" extensions to steal credentials, restarts, junk messages, internal proxy access, and exchanges. The main operational point is scope: Falcon is not just serious theft but persistent control at the browser level. Its use of per-session obfuscation, WebSocket C2, wide-privilege extensions, and continued delivery of Antino via flash updates presents a layered access chain built for continuous intelligence gathering. 🛰️ Open sources - closed narratives.

🔍 Falcon C2 turns browsers into intrusion platforms Between March and May 2026, Falcon C2, a NodeJS browser compromise framework also tracked as XG/XIng Gē, was used against government and law enforcement in one Middle East and four Southeast Asian countries. The operators injected malicious JavaScript into government portals and e-mail, then used Chrome and Firefox "PDF Viewer" extensions to steal credentials, restarts, junk messages, internal proxy access, and exchanges. The main operational point is scope: Falcon is not just serious theft but persistent control at the browser level. Its use of per-session obfuscation, WebSocket C2, wide-privilege extensions, and continued delivery of Antino via flash updates presents a layered access chain built for continuous intelligence gathering. 🛰️ Open sources - closed narratives.