A fake PDF reader gave an operator a view into a justice department’s daily work. In one incident described by Unit 42 on November 11, a compromised browser checked in every three to four minutes for more than three weeks. When its user opened a document seeking approval to release detained people, the operator captured the full page.
The researchers call the framework Falcon C2, also known as XG or Xiàng Gē. Their new report describes government compromises in one Middle Eastern country and four Southeast Asian countries, with campaigns observed between March and May 2026. This is newly published research about earlier intrusions, rather than evidence that those attacks began this week. [1]
The page and the extension opened different doors
Falcon first matters as JavaScript running inside a compromised website. In April, the researchers found a script injected into the header of a Middle Eastern foreign ministry’s Roundcube webmail portal. It loaded an obfuscated implant that let the operator intercept sign-ins and monitor the affected webmail sessions. Unit 42 identified 39 affected Roundcube instances in that country; it reported no evidence of instances outside it.
That access has a boundary: code executing in a webpage is different from an installed browser extension with broad permissions. Falcon has Chrome and Firefox extensions that expand its reach beyond the original tab. The Chrome version poses as PDF Viewer. Unit 42 has not established how operators generally get the extensions installed. The report discusses possible social engineering and an installation utility, but those possibilities do not prove an automatic installation or a browser zero-day.
In the justice-related case, the observed Chrome extension was sideloaded using developer mode. Its identifier was mbidcmlcbgbphpoacojjbmfpohcimjji. A familiar display name alone cannot identify it: legitimate PDF tools and Chrome’s built-in viewer are not the same thing as this reported extension.
The attacker borrowed the browser’s authenticated access
The extension supplied the operator with more than a password list. It could relay requests through the victim’s browser using the browser’s stored session data, then return the response over its command channel. To the destination service, that request could arrive with the victim’s authenticated session attached.
This explains why the browser was valuable as a proxy. The operator did not need to recreate every sign-in step on a separate computer before asking the already authenticated browser for a resource. The report also describes a Gmail collection module that could retrieve messages and attachments through an authenticated session. That capability is not evidence of a flaw in Gmail itself.
In the justice department intrusion, the evidence went beyond theoretical features. Unit 42 recorded plaintext credentials for the internal document system, more than 20 additional routing-slip page views from late April to mid-May, and the deliberately captured document screenshot. The combination shows both ongoing collection and an operator choosing a particular document when it appeared.
A download could keep its name while changing its source
Falcon’s extension can also replace downloads under rules chosen by the operator. The researchers illustrate a rule targeting executable downloads from Google domains. The extension cancels the original transfer, removes it from download history and starts a replacement. The file can still appear as ChromeSetup.exe, while its recorded origin points to the replacement host.
The useful distinction is between a capability demonstrated in the framework and delivery observed in a particular campaign. In a separate police-entity case, the operator harvested usernames from an internal web application, then showed a fake Adobe Flash update only to selected users. That lure delivered the Windows implant Antino. It is a different deployment path from the PDF extension case; the report does not establish that every Falcon visitor received a Windows payload.
Unit 42 assesses Falcon and the previously documented PeckBirdy framework as variants of the same core framework, based on their delivery paths, communication and tracking conventions. That technical relationship does not turn every earlier casino-domain observation into a confirmed victim of these government campaigns.
Check the access that actually existed
For a potentially affected organization, start with the browser profile and the web application involved: preserve extension identifiers and installation details, unusual script changes, session activity and relevant network logs. A page-script exposure, an installed extension and a downloaded executable require different containment work. Do not visit the published malicious infrastructure to test an alert.
If an unauthorized extension is present, contain the affected device and investigate before trusting the same profile with recovery credentials. From a clean device, revoke exposed sessions and change affected credentials. If an extension returns after removal, the recurring-extension recovery guide covers the separate installation and policy problem. Where a suspicious Windows installer also ran, removing a visible payload may leave a loader, task or browser change behind; device cleanup and account recovery address different parts of the incident.
The revealing detail is the routing slip: a browser that continued doing normal office work also served as the operator’s observation point. Closing one infected tab cannot be treated as complete remediation when a separately installed extension remains.
References
- Unit 42. The XG Files: Falcon C2 Flying Under The (Browser) Radar. Palo Alto Networks, November 11, 2026; accessed November 12, 2026. Campaign evidence, extension analysis and proxy diagram.
