Falcon: Unit 42 describes a browser-resident command-and-control framework planted in government webmail and web applications, with a script tag in Roundcube at a Middle Eastern foreign ministry and a sideloaded 'PDF Viewer' extension elsewhere; it shares its core with PeckBirdy

Unit 42 describes Falcon C2, also called XG and not the CrowdStrike Falcon sensor, a NodeJS command-and-control framework whose operator-controlled JavaScript implant runs inside the victim's browser, so the endpoint holds no file for it (Unit 42, 2026-11-11). A script tag placed in a trusted site makes each visit request the implant from the Falcon server, which returns a script obfuscated per browser session, and the implant then holds a TLS WebSocket to the server while the tab is open and runs operator JavaScript through eval (Unit 42, 2026-11-11). Unit 42 identified compromised government entities in one Middle Eastern and four Southeast Asian countries between March and May 2026, among them ministries and law enforcement agencies, and names no actor (Unit 42, 2026-11-11).

In April 2026 a script tag inserted into the Roundcube webmail portal of a Middle Eastern ministry of foreign affairs let the operator intercept credentials as users signed in and monitor sessions (39 Roundcube instances in that country, none observed elsewhere; how the tag got in is not stated) (Unit 42, 2026-11-11). In May 2026 a module in a Southeast Asian police web application harvested usernames and then showed a fake Adobe Flash Player update prompt to chosen users, which served the Antino implant that uses Microsoft OneDrive for command and control (Unit 42, 2026-11-11). Against a justice-department entity in another country, a Chrome extension named PDF Viewer, sideloaded in developer mode, checked in every 3 to 4 minutes for over three weeks and exfiltrated plaintext credentials for an internal correspondence system and a screenshot of a document the victim was viewing (Unit 42, 2026-11-11). The Jewelbug campaign also used an extension named PDF Viewer (Symantec, 2026-08-13); Unit 42 lists it only as a further resource.

Unit 42 assesses with high confidence that Falcon and PeckBirdy (Trend's JScript framework used by China-aligned actors since 2023) are variants of one core framework; that is code lineage, not who operates Falcon (Unit 42, 2026-11-11; Trend Micro, 2026-01-26).

Triage: Unit 42's basis for the cookie check is that Baidu Analytics cookies are normal on sites that use that service and anomalous on internal government web applications where it has no reason to appear (Unit 42, 2026-11-11).