Security researchers have exposed a spying framework that turns an ordinary web browser into a surveillance tool, after it was used against government targets in five countries. Palo Alto Networks' Unit 42 team published its investigation into Falcon, also known as XG, on 11 November, and the findings were widely reported on Thursday 12 November.

Falcon is a command-and-control framework written in Node.js. Rather than infecting a computer with a conventional virus, it plants malicious JavaScript directly into webmail portals and government web applications, so that anyone who visits the compromised site is caught inside their own browser. From there, the operator can steal passwords, emails, session cookies and private communications, and can even use the victim's browser as a proxy to reach internal systems.

Unit 42 says the campaigns it observed ran between March and May 2026 and hit government bodies in one Middle Eastern country and four Southeast Asian countries. The targets were ministries of foreign affairs, defence and interior, along with law enforcement agencies, a pattern the researchers say is consistent with strategic intelligence collection. In one country, the researchers counted 39 compromised instances of Roundcube, the open-source webmail software used by many government departments.

How Falcon turns a browser into a spy tool

When a person visits an affected website, the site sends a request to the Falcon server, which generates a small implant tailored to that browser session. The implant keeps a persistent session identifier using three storage methods at once, including a cookie and a local storage key that mimic Baidu Analytics tracking names, so it survives browser restarts and blends in with ordinary web traffic.

The implant talks back to its controller over an encrypted WebSocket connection, sending a heartbeat every minute while the tab stays open. It can run any JavaScript the operator sends it. In one case involving a justice department, Unit 42 found that a compromised browser checked in every three to four minutes for more than three weeks, giving the operator a long window into the victim's daily work.

The framework's most dangerous trick is its web proxy capability. The operator can route requests through the victim's browser, using the victim's own session cookies and credentials, to open internal documents and systems as if they were the victim. Unit 42 describes a case in which the operator read internal document-system pages, including routing slips, through exactly this method.

The fake PDF Viewer extension

Falcon also comes with malicious browser extensions for Chrome and Firefox. The Chrome version poses as a PDF reader called PDF Viewer, version 2026.5.13.1, and asks for 40 permissions, including access to credentials, cookies and browser network traffic. Its identifier is mbidcmlcbgbphpoacojjbmfpohcimjji.

Once installed, the extension can scrape credentials and clipboard contents, hook network requests, intercept downloads and replace them with attacker-controlled files. Unit 42 gives the example of a legitimate download being swapped for a file that still appears to be called ChromeSetup.exe. It can also quietly collect Twitter direct messages, Discord chats, Gmail contents and messages from Zalo, the chat app widely used in Vietnam.

Unit 42 says it does not yet know how victims are persuaded to install the extension, but notes that the Falcon management panel contains tools for silently installing it on Chrome and Firefox, and that social engineering is a likely route.

Antino and the OneDrive channel

Falcon also delivers a second-stage implant called Antino, written in the Rust programming language. Antino uses Microsoft OneDrive as its command-and-control channel, which helps it hide among legitimate cloud traffic. It supports shell commands, file transfers and system information collection.

The researchers assess with high confidence that Falcon is a variant of PeckBirdy, a scripting framework reported by Trend Micro in January 2026. The two share near-identical web address structures, payload delivery methods and communication protocols, and both store their session identifiers using the same Baidu-mimicking naming convention.

What defenders should do

Unit 42 has not named the operator behind Falcon. Organisations that run webmail or government portals should check for unexpected JavaScript on their sites, review browser extensions installed across their estate, and treat any extension matching the PDF Viewer identifier as hostile. Administrators should also watch for unusual OneDrive traffic and for the Hm_lvt_ session markers Falcon uses to track victims.

Sources: Palo Alto Networks Unit 42, Gridinsoft and The Hacker News.