Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

A Third Chinese Group Weaponizes the Same Exploit Chain

Researchers at Volexity have identified a third China-linked threat group, tracked as UTA0565, exploiting a chained set of Chrome and Windows zero-day vulnerabilities to deploy a previously undocumented malware family it calls CLEANGULP. Volexity observed the campaign on September 3-4, 2026, while the underlying flaws were still unpatched.

The activity follows Volexity's earlier September 9 report on two other China-linked groups, UTA0560 and JungleBamboo, using the same core exploit chain — suggesting the toolkit was shared, customized, and deployed independently by multiple operators, consistent with a coordinated effort within China's offensive cyber ecosystem.

The Exploit Chain

UTA0565's campaigns stood out from the other two groups by relying on multiple fake websites to lure victims, rather than a single compromised or spoofed domain. One phishing lure sent to Asian government entities used Chinese-language messaging urging recipients to publicly support imprisoned Hong Kong activist Chow Hang-tung and amplify opposition to Chinese Communist Party suppression of June 4th commemorations.

Spoofed Infrastructure

Volexity identified several spoofed domains tied to the group with medium confidence, impersonating media outlets, corporate-training services, and restaurant directories — likely serving as exploit hosts, malware delivery points, or command-and-control infrastructure:

• outsourcingwise[.]net
• halal-navi[.]net
• halaltak[.]net
• borneobulletins[.]top
• thecovnresation[.]net / thecovnresation[.]com

CLEANGULP Malware

The final payload — downloaded as chrome_cleanup.exe from americanprgoress[.]top — is an 893 KB Windows executable that Volexity now tracks as CLEANGULP, a previously undocumented family written in C and compiled with the Microsoft Visual C++ compiler. The binary is heavily obfuscated using control-flow flattening and indirect calls to hinder analysis.

Persistence and capabilities:

• Installs itself at %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe
• Creates a scheduled task named MicrosoftIME for persistence
• Executes shell commands
• Lists running processes
• Uploads and downloads files
• Executes beacon object files (BOFs)

Detection and Mitigation

1. Apply Chrome and Windows security updates immediately — CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 should all be treated as urgent, even where vendor patches were pending at time of exploitation.
2. Block the spoofed domains listed above at the network and DNS layer.
3. Hunt for MicrosoftIME.exe under %LOCALAPPDATA%\Microsoft\IME\ and a scheduled task named MicrosoftIME.
4. Investigate suspicious Chrome child-process activity, particularly processes spawned outside normal browser behavior following a page visit.
5. Treat phishing lures referencing politically sensitive topics (e.g., Hong Kong activism, June 4th) targeting government or NGO staff as a high-confidence indicator of targeted, not commodity, activity.

Sources

• Volexity — Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits
• CyberScoop — Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects