The Antino spy implant that Cisco Talos tied to attacks on Asian governments last month also reached targets through a second route: malicious code planted in government webmail and police web portals, according to research published Wednesday.
Palo Alto Networks’ Unit 42 found the injected code was delivered by a browser-based framework it calls Falcon, which it assessed with high confidence is a variant of PeckBirdy, a tool Trend Micro linked to China-aligned groups in January. The code harvested passwords, emails and session cookies from ministries in one Middle Eastern country and four in Southeast Asia.
Talos reported in October that a China-nexus group it tracks as UAT-11587 used Antino against at least 16 government and policy organizations in eight Asian countries, compromising about 350 endpoints. In those attacks, Antino arrived through spearphishing emails. Unit 42 links the tools, not the operators. It did not attribute the Falcon activity to UAT-11587 or any other actor.
Palo Alto Networks told Security Point Break that Unit 42 identified four IP addresses used to test and administer Falcon, and that the infrastructure overlaps with more than one activity cluster the team tracks. Several threat actors operating under the same umbrella may use the framework, the company said.
A Familiar Target, a Different Method
Government webmail has been a steady espionage target for years. ESET reported in May 2025 that the Russia-aligned group Sednit, also known as APT28, exploited cross-site scripting flaws in Roundcube, Horde, MDaemon and Zimbra to steal mail from Ukrainian government bodies and defense firms in Bulgaria and Romania. One of those flaws, in MDaemon, was a zero-day. In July, Proofpoint said a likely China-aligned group it tracks as UNK_MassTraction used two Roundcube flaws to break into mail servers at U.S. and Canadian universities.
Gregory Lesnewich, principal threat research engineer at Proofpoint, said the strategic value of government webmail has long made Roundcube an espionage target, but his team has not seen evidence that China is disproportionately targeting it right now. Patching alone is not enough, he said, because there are “relatively few security products designed to provide EDR-like detection for these systems.” He advised organizations to add monitoring and threat hunting inside their Roundcube environments.
The Falcon campaign differs in where the attack lives. The earlier campaigns relied on specially crafted emails that a target had to open. In the Falcon case, the attackers altered the portal itself. Unit 42 assessed with high confidence that the injected script ran every time a victim visited the Roundcube portal.
That approach is uncommon. Matthieu Faou, senior malware researcher at ESET, said tampering with the portal is “significantly less frequent than delivering XSS exploits by email.” Webmail software has far more cross-site scripting flaws than remote code execution bugs, the kind that let an attacker take control of the server, he said.
In an emailed response, Palo Alto Networks said Unit 42 assesses with moderate confidence that the attackers likely used access they already had to inject the scripts. The company did not say how that earlier access was obtained.
Faou said some organizations moved to Roundcube and Zimbra after the 2021 ProxyLogon and ProxyShell flaws in Microsoft Exchange. Those platforms have a different attack surface, he said, and a large number of cross-site scripting flaws have been found in them.
Inside the Falcon Campaign
The Falcon intrusions ran from March to May 2026. Victims included ministries of defense, interior and foreign affairs, a police agency, an intelligence directorate, justice departments and a military entity. Unit 42 did not name the countries.
In the Middle Eastern case, attackers added a script tag to a foreign ministry’s Roundcube webmail portal in April. Unit 42 counted 39 affected Roundcube instances in that country. The injected code runs entirely in the browser and keeps a live connection to the operator open for as long as the tab stays open.
At a Southeast Asian police agency, a fake Adobe Flash update prompt delivered Antino, a Rust-based Windows implant that uses Microsoft OneDrive as its command channel. The operators also pushed rogue Chrome and Firefox extensions disguised as a PDF viewer that could steal credentials and cookies and route traffic through the victim’s logged-in session. At one justice agency, an extension stayed active for more than three weeks and gave the operator access to an internal document system.
Trend Micro reported that PeckBirdy had been in use since 2023 against Chinese gambling sites and Asian government bodies. Falcon keeps PeckBirdy’s URL structure, payload delivery sequence and session naming, but replaces its fixed encryption key with one negotiated for each session. Unit 42 said AI likely helped write Falcon, based on its coding style and inconsistent design choices.
Palo Alto Networks said agencies running self-hosted webmail should first inspect the HTML source of their login and portal pages. In the Falcon attacks, the operators placed a script tag in the head of the login page that called an external server, fonts.tarotfree101[.]top, which built and ran the implant. The company also advised checking firewall and proxy logs for unusual outbound WebSocket connections from the webmail site to unfamiliar domains, looking for “Hm_lvt_” cookies or storage keys on the portal, rotating hosting and webmail administrator credentials, and keeping Roundcube on its latest security release.
Unit 42’s report also advises watching for browser extensions installed in developer mode and OAuth activity to OneDrive tenants an organization does not own.
Updated Nov. 11, 2026, at 6:45 p.m. ET to add comment from Gregory Lesnewich of Proofpoint, Matthieu Faou of ESET and a response from Palo Alto Networks.
