Browser-Compromise - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/browser-compromise/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 15:39:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFalcon C2 Browser-Based Threat Frameworkhttps://feed.craftedsignal.io/briefs/2026-11-falcon-c2/Wed, 11 Nov 2026 15:39:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-falcon-c2/Falcon is a browser-based C2 framework used to compromise webmail and government portals by injecting malicious JavaScript to steal sensitive information and deliver the Antino implant.Falcon (aka XG or Xiàng Gē) is a browser-based command and control framework that compromises browser sessions via malicious JavaScript. Attackers have used the framework to target government entities in one Middle Eastern and four Southeast Asian countries. The framework supports the deployment of malicious Chrome and Firefox extensions that grant full browser control, including access to credentials, session cookies, and network traffic.

Attack Chain

  • Infection: Malicious JavaScript is injected directly into webmail and government portals.
  • Execution: The browser executes an obfuscated JavaScript implant that establishes a persistent WebSocket connection to the C2 server.
  • Persistence: Persistence is maintained through a three-tier strategy involving browser local storage, cookies, and extension storage.
  • Capabilities: The framework facilitates data exfiltration (passwords, emails, session cookies), proxy functionality using the victim's browser, and the delivery of the Antino implant.

Impact

Falcon was used to target ministries of foreign affairs, defense, interior, and law enforcement agencies for strategic intelligence collection.

Recommendation

Organizations should monitor browser environments for unauthorized extensions and suspicious WebSocket traffic. Conduct analysis of browser-based data exfiltration and ensure rigorous access control for web applications.

]]>highthreatc2browser-compromiseinfostealergovernment-targeting