Falcon: review trust in the browser session
The Falcon research places the browser within response scope. Connect what the portal delivers, who controls extensions, and which accesses need reassessment.
Portekizce okuBy Pentesty
The starting point for investigation
On November 11, 2026, Unit 42 published research about Falcon, with observations from March through May in government entities. The report describes JavaScript in compromised portals and malicious extensions capable of reaching data and sessions. The researchers say they do not know how operators distribute those extensions.
This guides assessment questions without establishing that a reader’s organization was affected. A local investigation must start with its own assets and records. A tool name or an extension’s appearance cannot replace the connection between a change, a user, and an observed access.
Assign ownership to what the portal delivers
Choose a representative corporate application and identify who approves its files, page templates, and dependencies. Compare published content with the version approved for that environment. Record emergency changes too: they need a verifiable explanation when the comparison finds differences.
In staging, use a preauthorized harmless change to check whether the team can detect, attribute, and reverse a publication outside the expected procedure. Do not inject the malware described in the research. The criterion is recognizing a change without relying on someone remembering how the page should look.
Treat an extension as a managed component
Sample browser profiles used for sensitive tasks. For each extension, collect its identifier, version, installation origin, internal owner, and approved permission scope. A commercial description or familiar icon does not explain why that component is authorized to operate in the profile.
Ask the owner to demonstrate how an exception is granted and withdrawn. Compare an ordinary workstation with an administrative workstation without copying data between profiles. If the organization cannot explain an installation, record the component as an unresolved decision and preserve what investigation requires.
Correlate three views of the same access
A browser observation, an application authentication, and a device record may have different owners. Define a test identifier that connects all three datasets. Record time zones, timestamps, and collection gaps before attempting to reconstruct a session’s sequence.
Use a synthetic account for a normal task and confirm who can explain its origin, destination, and result. If a dashboard receives no event, determine whether activity or visibility was missing. The absence of an alert alone does not demonstrate that every relevant path was observed.
Plan recovery around granted access
Write a matrix connecting the user, application, profile, and person responsible for ending access. In an authorized exercise, withdraw test access and verify the result in the corresponding application. Record device cleanup, the account decision, and post-recovery functionality separately.
Do not treat the browser’s return to service as automatic approval of every user integration. Each access has an owner and a purpose. When evidence is insufficient to close a particular session, maintain the restriction and define the next step with the service owner.
Make acceptance answer a business question
Choose an essential task, such as consulting an internal document under appropriate authorization. The process owner should confirm that the right user can work again and that agreed restrictions remain valid. Keep the control execution as a reference for later portal or browser changes.
The final report should separate observed findings, investigative hypotheses, and recommendations. State which profiles were outside the sample and who will oversee expanded work. A limited, repeatable conclusion helps operations more than a broad statement without demonstrable coverage.
Frequently asked questions
Does the research confirm a current campaign in our company?
The report does not establish local impact. Investigate your records and distinguish observation from publication dates.
How was the extension installed?
Unit 42 states that distribution is unknown. Do not present installation hypotheses as facts; preserve the origin identified in your environment and investigate missing information.
Should we execute Falcon to validate controls?
This plan uses synthetic accounts and harmless staging changes. Any more invasive exercise requires its own scope, authorization, and criteria before execution.
What evidence closes recovery?
The decision should connect the device, reviewed access, and an authorized task that works again. Exceptions and unassessed profiles must remain explicit in the final record.
Sources and references
Original Pentesty analysis, published November 14, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.