{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/browser-compromise/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["c2","browser-compromise","infostealer","government-targeting"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eFalcon (aka XG or Xiàng Gē) is a browser-based command and control framework that compromises browser sessions via malicious JavaScript. Attackers have used the framework to target government entities in one Middle Eastern and four Southeast Asian countries. The framework supports the deployment of malicious Chrome and Firefox extensions that grant full browser control, including access to credentials, session cookies, and network traffic.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eInfection\u003c/strong\u003e: Malicious JavaScript is injected directly into webmail and government portals.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExecution\u003c/strong\u003e: The browser executes an obfuscated JavaScript implant that establishes a persistent WebSocket connection to the C2 server.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePersistence\u003c/strong\u003e: Persistence is maintained through a three-tier strategy involving browser local storage, cookies, and extension storage.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCapabilities\u003c/strong\u003e: The framework facilitates data exfiltration (passwords, emails, session cookies), proxy functionality using the victim's browser, and the delivery of the Antino implant.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eFalcon was used to target ministries of foreign affairs, defense, interior, and law enforcement agencies for strategic intelligence collection.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eOrganizations should monitor browser environments for unauthorized extensions and suspicious WebSocket traffic. Conduct analysis of browser-based data exfiltration and ensure rigorous access control for web applications.\u003c/p\u003e\n","date_modified":"2026-11-11T15:39:25Z","date_published":"2026-11-11T15:39:25Z","id":"https://feed.craftedsignal.io/briefs/2026-11-falcon-c2/","summary":"Falcon is a browser-based C2 framework used to compromise webmail and government portals by injecting malicious JavaScript to steal sensitive information and deliver the Antino implant.","title":"Falcon C2 Browser-Based Threat Framework","url":"https://feed.craftedsignal.io/briefs/2026-11-falcon-c2/"}],"language":"en","title":"CraftedSignal Threat Feed - Browser-Compromise","version":"https://jsonfeed.org/version/1.1"}