The XG Files: Falcon C2 Flying Under The (Browser) Radar

    Thursday, November 12, 2026 In: Threat Research Print

    Date: 11/12/2026

    Severity: High

    Summary

    Falcon (also known as XG or Xiàng Gē) is a browser-based command-and-control (C2) framework that uses malicious JavaScript and fake browser extensions disguised as legitimate PDF readers to compromise users. It steals sensitive information, including passwords, session cookies, emails, and browsing history, while supporting browser-based proxying and data exfiltration. The campaign primarily targets government organizations across the Middle East and Southeast Asia, particularly defense, foreign affairs, and law enforcement agencies. Its techniques allow attackers to conduct espionage while hiding malicious activities within normal browser operations.

    Indicators of Compromise (IOC) List

    Domains/URLs

    fonts.tarotfree101.top

    fonts.chrorne.com

    robot.avbliud.com

    microsoft-flash.com

    wps-cn.com

    Hash

    3e535d63af8a95221fb517fa1b3e4a0029d3463d8b767443abdff385ee8cb6e9

    f8b86238e179d88a9979b6f97750a39dda1d07b54d634bc1348fdfb0944a3b92

    88e8b07bdf294ace0357d35acb7e108c66ba65a2c4ad66351fb8f7806dae0862

    065d18fcfeddbd718c054f4b21c3cde5b9291db921d01f343d7ac0d4b41f29ce

    3eab406d841fa22a4b0200c95c1afab068347f835400d5771e8de60aef732016

    5711586125909863b91c1b5ff7cf70ef5d35249d67b11d7a23dc864405cddfe2

    b6a7be724871ed3e81c986b74d62da8911c82a336c4c1857b35f2446b2d49fda

    2ed834d92bfefc9d07a9f1a48f986974ae2a29669029f8163a1f6e8706388fcd

    356b96c2267c5f2d8c07693643626e090b6389318b4ffa74699fa1732da5a00c

    32af8413cbd38ce8beb257288cb8e6aa2f9b781d56d0f5272bffbcdc22d999f4

    e2b6b1becdbcc340121e163b5afdfc5437a480ca132248ed5c7c309c45ac3dbb

    265c2b36060e4b21c25aa86a8bb22d1db5f806117b484774c75c65b5b38222e0

    66e9098551a1c0c74077d6cf55570e5d307a4a5ef0b0f2053e139394e61c442d

    3e923f11db08413fca8a3a69d33d8896cfd56309e5179e8604d7fb7110428da2

    3e535d63af8a95221fb517fa1b3e4a0029d3463d8b767443abdff385ee8cb6e9

    2ebe36f1322b77264a33fded81cd4b8817f93362945070bf0bb5845dd27c0575

    857429faffe0e0747ce299e86eed063ed781b4e403b917ca7e853e89bedf072c

    065d18fcfeddbd718c054f4b21c3cde5b9291db921d01f343d7ac0d4b41f29ce

    3eab406d841fa22a4b0200c95c1afab068347f835400d5771e8de60aef732016

    5711586125909863b91c1b5ff7cf70ef5d35249d67b11d7a23dc864405cddfe2

    b33f2e95943e3ff0a72dea1be9fdea03d986bada4def34f6991b3113ec161ad7

    2ed834d92bfefc9d07a9f1a48f986974ae2a29669029f8163a1f6e8706388fcd

    898656c33effb51e109c548fc213f157f151a870ea64a4601eda74ae75bd3af6

    32af8413cbd38ce8beb257288cb8e6aa2f9b781d56d0f5272bffbcdc22d999f4

    e2b6b1becdbcc340121e163b5afdfc5437a480ca132248ed5c7c309c45ac3dbb

    265c2b36060e4b21c25aa86a8bb22d1db5f806117b484774c75c65b5b38222e0

    b3d8ea89b19a87bf2fdd63127086681059f41d67b6e5f8c939f5636a1b2315ce

    24d69139cb2d32598f0f4983876f6320485fac134a66ade59cab76b50b4128f7

    0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "robot.avbliud.com" or url like "robot.avbliud.com" or siteurl like "robot.avbliud.com" or domainname like "microsoft-flash.com" or url like "microsoft-flash.com" or siteurl like "microsoft-flash.com" or domainname like "fonts.tarotfree101.top" or url like "fonts.tarotfree101.top" or siteurl like "fonts.tarotfree101.top" or domainname like "fonts.chrorne.com" or url like "fonts.chrorne.com" or siteurl like "fonts.chrorne.com" or domainname like "wps-cn.com" or url like "wps-cn.com" or siteurl like "wps-cn.com"

    Detection Query 2 :

    sha256hash IN ("0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd","3e535d63af8a95221fb517fa1b3e4a0029d3463d8b767443abdff385ee8cb6e9","f8b86238e179d88a9979b6f97750a39dda1d07b54d634bc1348fdfb0944a3b92","88e8b07bdf294ace0357d35acb7e108c66ba65a2c4ad66351fb8f7806dae0862","065d18fcfeddbd718c054f4b21c3cde5b9291db921d01f343d7ac0d4b41f29ce","3eab406d841fa22a4b0200c95c1afab068347f835400d5771e8de60aef732016","5711586125909863b91c1b5ff7cf70ef5d35249d67b11d7a23dc864405cddfe2","b6a7be724871ed3e81c986b74d62da8911c82a336c4c1857b35f2446b2d49fda","2ed834d92bfefc9d07a9f1a48f986974ae2a29669029f8163a1f6e8706388fcd","356b96c2267c5f2d8c07693643626e090b6389318b4ffa74699fa1732da5a00c","32af8413cbd38ce8beb257288cb8e6aa2f9b781d56d0f5272bffbcdc22d999f4","e2b6b1becdbcc340121e163b5afdfc5437a480ca132248ed5c7c309c45ac3dbb","265c2b36060e4b21c25aa86a8bb22d1db5f806117b484774c75c65b5b38222e0","66e9098551a1c0c74077d6cf55570e5d307a4a5ef0b0f2053e139394e61c442d","3e923f11db08413fca8a3a69d33d8896cfd56309e5179e8604d7fb7110428da2","3e535d63af8a95221fb517fa1b3e4a0029d3463d8b767443abdff385ee8cb6e9","2ebe36f1322b77264a33fded81cd4b8817f93362945070bf0bb5845dd27c0575","857429faffe0e0747ce299e86eed063ed781b4e403b917ca7e853e89bedf072c","065d18fcfeddbd718c054f4b21c3cde5b9291db921d01f343d7ac0d4b41f29ce","3eab406d841fa22a4b0200c95c1afab068347f835400d5771e8de60aef732016","5711586125909863b91c1b5ff7cf70ef5d35249d67b11d7a23dc864405cddfe2","b33f2e95943e3ff0a72dea1be9fdea03d986bada4def34f6991b3113ec161ad7","2ed834d92bfefc9d07a9f1a48f986974ae2a29669029f8163a1f6e8706388fcd","898656c33effb51e109c548fc213f157f151a870ea64a4601eda74ae75bd3af6","32af8413cbd38ce8beb257288cb8e6aa2f9b781d56d0f5272bffbcdc22d999f4","e2b6b1becdbcc340121e163b5afdfc5437a480ca132248ed5c7c309c45ac3dbb","265c2b36060e4b21c25aa86a8bb22d1db5f806117b484774c75c65b5b38222e0","b3d8ea89b19a87bf2fdd63127086681059f41d67b6e5f8c939f5636a1b2315ce","24d69139cb2d32598f0f4983876f6320485fac134a66ade59cab76b50b4128f7")

    Reference:    

    The XG Files: Falcon C2 Flying Under The (Browser) Radar   


    Tags

    MalwareGovernment Services and FacilitiesStealerCredential HarvestingExfiltrationThe Middle EastSoutheast AsiaDefense Industrial Base

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.