Falcon browser spy framework: attackers plant scripts in government webmail (Roundcube) and portals, sideload a fake 'PDF Viewer' Chrome/Firefox extension and drop the Antino backdoor that uses OneDrive (Unit 42)

Unit 42 (11 Nov 2026) describes Falcon (aka XG / Xiang Ge), a command-and-control framework that runs as JavaScript inside the victim's browser. The operator added a script tag to Roundcube webmail and other government web applications so every visitor loads the Falcon implant, which keeps an encrypted WebSocket open and lets the operator run any JavaScript in the page, harvest usernames and steal logins and session cookies. Unit 42 counted 39 affected Roundcube instances at a Middle Eastern foreign ministry. At a Southeast Asian police entity, selected users were shown a fake Adobe Flash Player update that installed Antino, a Rust backdoor that uses Microsoft OneDrive for command and control. At a Southeast Asian justice entity, a Chrome extension posing as 'PDF Viewer' was sideloaded in developer mode and ran for 3+ weeks; it reads saved passwords, cookies, history and clipboard, swaps file downloads for the operator's, proxies requests with the victim's session, and scrapes Gmail, X/Twitter DMs, Discord and Zalo. How the extension is installed is unknown (the panel lists silent-install tools for Chrome and Firefox). Confirmed victims: foreign, defense and interior ministries, police, justice, military and a telecom in one Middle Eastern and four Southeast Asian countries, March to May 2026; Antino dates back to at least Oct 2025. Whether the activity continues now is unknown; how the attackers got write access to the portals is not stated.