The XG Files: Falcon C2 Flying Under The (Browser) Radar

Falcon (also known as XG or Xiàng Gē) is a sophisticated browser-based command and control (C2) malware framework operating via malicious JavaScript. It compromises webmail portals and government web applications to sideload malicious Chrome and Firefox extensions that steal sensitive data such as passwords, emails, session cookies, and communications. Falcon delivers an implant called Antino, which uses Microsoft OneDrive as a covert C2 channel. Between March and May 2026, it targeted government entities in one Middle Eastern and four Southeast Asian countries, focusing on ministries of foreign affairs, defense, interior, and law enforcement. The framework exhibits advanced capabilities including browser proxying, download interception, network traffic hijacking, and credential harvesting, with overlaps to the PeckBirdy malware family.

• Beware of Phishing Email Disguised as Quotation Inquiry (SnakeKeylogger)Malware2026-11-12
• Off the Rails: Inside an Exposed Silent Lynx ServerMalware2026-11-11
• ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data ExfiltrationHighVulnerability2026-11-05
• Google Brotli · 2nd November · Threat Intelligence ReportExploitedBreach2026-11-02
• Inside a malicious Claude Code-branded extension and its persistent SSH backdoorMalware2026-10-31