New 'BlueMoon' Exploit Kit Chains Chrome and Windows Zero-Days for Espionage

A Shared Exploit Kit Spreads Across Multiple Spy Groups

Proofpoint researchers have identified a new exploit kit — dubbed BlueMoon — that chains Chrome browser and Windows vulnerabilities to deploy backdoors and surveillance tools. Since late August 2026, at least four distinct espionage-motivated threat clusters have adopted it, with the majority showing a suspected China nexus. Google's Threat Intelligence Group, Microsoft's MSTIC, and Volexity also contributed to the investigation.

Timeline and Attribution

The first observed use came from TA412 (also tracked as JungleBamboo, Violet Typhoon, APT31, TIDE CASTLE) — a China-nexus actor linked to the Ministry of State Security's Hubei State Security Department and indicted by the US government in 2024 for economic espionage. Starting August 28, 2026, TA412 targeted US NGOs, mining companies, and physical commodity trading firms with phishing emails posing as university students seeking internships or as outreach tied to the Association for Asian Studies conference.

Within days, the exploit chain spread to other clusters targeting US aerospace companies, Vietnamese manufacturers, and government, financial, and consulting organizations in Indonesia and Singapore. Researchers caution that while the majority of observed usage leans China-nexus, BlueMoon "may not be exclusive to China-aligned actors" — some activity remains unattributed, and additional actors may already be using the kit.

The Exploit Chain

BlueMoon links three vulnerabilities into a single attack path:

1. CVE-2026-85046 — a type-confusion flaw in Chromium's V8 engine, enabling remote code execution inside the browser renderer by abusing a JIT-compiler optimization bug
2. CVE-2026-87491 — a V8 sandbox escape that corrupts WebAssembly metadata to run embedded shellcode
3. CVE-2026-85880 — a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), used for kernel-level privilege escalation

Both V8 flaws were patch-gap zero-days: the fixes already existed in Chromium's public source but hadn't yet reached stable browser releases, giving the exploit developer roughly a four-week window to reverse-engineer a working exploit before patches shipped to end users. CVE-2026-85046 was patched by Google last week; CVE-2026-85880 was addressed in Microsoft's September 2026 Patch Tuesday.

How It Behaves on a Compromised Host

Once triggered, BlueMoon uses a reflective DLL to fingerprint the host — Windows version, build number, token integrity level, and kernelbase.dll details — before deciding whether to fire the Windows kernel exploit. The privilege-escalation stage only targets older Windows builds: Windows 10 builds 17763 and 19041–19045, Windows Server 2019 and 2022, and Windows 11 21H2. After elevation, it injects a CreateProcess stub into Chrome's broker process and executes an operator-defined command — by default, downloading and launching an executable via curl.

Delivery starts with phishing: a malicious link silently loads BlueMoon, then redirects the victim to a legitimate site while exploitation runs in the background.

Signs of a Rushed Deployment

Proofpoint flagged several indicators that BlueMoon was pushed into use hastily rather than as part of a long-planned operation — most notably, delivery infrastructure was frequently registered the same day as each campaign launched.

Outlook

Researchers expect adoption to broaden beyond nation-state operators, warning that BlueMoon's modular design could eventually let financially motivated cybercriminals repurpose the same chain. With two of the three underlying flaws already patched and the third addressed this month, the immediate priority for defenders is closing the patch-gap window before it gets exploited again.

Recommendations

• Patch Chromium-based browsers immediately — do not wait for a scheduled update cycle
• Prioritize the September 2026 Windows Patch Tuesday update addressing CVE-2026-85880
• Flag and retire legacy Windows builds (10 17763/19041–19045, Server 2019/2022, 11 21H2) where feasible, since the kernel exploit stage targets them specifically
• Treat unsolicited internship or conference-outreach emails with embedded links as a phishing vector, particularly across NGO, aerospace, manufacturing, and government sectors

Sources

• The Hacker News — Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
• Security Affairs — Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days
• Cybersecurity News — Hackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks