China-linked hackers exploited a Chrome-Windows zero-day chain to deploy malware, with at least four threat groups using the BlueMoon exploit kit to target NGOs and organizations in September 2026, according to security firms. The attacks, which leveraged a patch gap in Chromium and AI-assisted exploit development, targeted Windows 10 (Oct. 2018 Update), Windows Server 2019, Windows 10 2004, Windows Server 2022, and the initial release of Windows 11, as reported by arstechnica.com.
China-linked hackers exploited a critical Chrome-Windows zero-day chain to deploy malware, with at least four threat groups using the BlueMoon exploit kit to target NGOs and organizations in September 2026. The attack chain leveraged three vulnerabilities—CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880—to bypass browser and operating system protections, enabling the deployment of backdoors like GRIMWEDGE and credential-stealing extensions like LONGTALE. securityaffairs.com noted that CVE-2026-87491, an out-of-bounds write flaw in V8, was the seventh actively exploited Chrome zero-day of 2026, with Google patching it in Chrome 153.0.8010.36 and later versions.
The BlueMoon Exploit Kit: A Rapidly Deployed Threat
The BlueMoon exploit kit, identified by Proofpoint, combined three vulnerabilities to execute arbitrary code on compromised systems. Two flaws targeted Chromium-based browsers—CVE-2026-85046, a type-confusion vulnerability in the V8 JavaScript engine, and CVE-2026-87491, an out-of-bounds write flaw affecting V8 and WebAssembly processing. The third, CVE-2026-85880, exploited a Windows kernel privilege escalation flaw. These vulnerabilities were patched in the past 24 hours, but attackers capitalized on the patch gap between upstream fixes and stable browser releases. arstechnica.com highlighted that the exploit chain targeted specific Windows versions, including the initial release of Windows 11.
Researchers from Volexity and Proofpoint noted that the exploit chain was deployed rapidly, with threat actors like UTA0560 (linked to China) and JungleBamboo (also known as APT31) using the chain to deliver malware. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals,
Proofpoint said. The attackers exploited a reflected cross-site scripting (XSS) vulnerability on a U.S. university website to redirect users to malicious infrastructure, where the exploit chain executed. thehackernews.com detailed how the attack began with spear-phishing emails urging recipients to click links to the university’s site, which then triggered the exploit chain.
Malware Deployment: GRIMWEDGE and LONGTALE
UTA0560, a China-linked group, deployed GRIMWEDGE, a JScript backdoor that enabled reconnaissance, file collection, and command execution. The malware used a scheduled Windows task for persistence and communicated with a command-and-control server at ocr.opusaccel[.]top.
GRIMWEDGE lacked exfiltration mechanisms but provided a foothold for further attacks. The backdoor provides an initial foothold on a compromised host sufficient enough for UTA0560 to survey the host, retrieve files of interest, and deploy additional tooling,
Volexity said. thehackernews.com noted that the malware embedded three binary payloads—p1, p2, and pp—within JavaScript, using Base64 encoding to bypass detection.
JungleBamboo, another China-linked group, used the same exploit chain to install SUPERSTOMP, a loader that deployed LONGTALE—a credential-stealing Chrome extension masquerading as a Google Gemini add-on. LONGTALE captured keystrokes, cookies, and session data, exfiltrating them to a C2 server roughly every 30 seconds. LONGTALE lacks even a basic remote code execution command that would enable the threat actor to conduct additional post-exploitation activity,
Volexity noted, suggesting the group prioritized data theft over broader system control. proofpoint.com confirmed that the exploit kit was first observed in late August 2026, with TA412 (JungleBamboo) as the initial cluster.
The exploit chain’s code included three binary payloads: p1 for host reconnaissance, p2 for privilege escalation, and pp for browser process injection. The final payload, “msgbox.exe,extracted a legitimate Windows binary and a malicious DLL (
wsc.dll”) to initiate a DLL sideloading chain. This method allowed attackers to bypass traditional detection mechanisms, though the exploit’s default configuration included a curl command to download and execute malware, increasing detection risk. thehackernews.com described how the DLL sideloading chain leveraged the device’s hostname to fetch an MSI installer containing the backdoor.
The Role of AI and Patch Gaps in Exploit Development
Proofpoint linked the rapid deployment of BlueMoon to AI-assisted exploit development, citing extensive diagnostic logging and comments in the exploit code that suggested automated testing. This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development,
the firm said. The exploit chain’s reliance on publicly available Chromium patches created a patch gap window, allowing attackers to reverse-engineer fixes before stable browser updates were released. arstechnica.com noted that the attackers moved quickly to exploit this gap.
Google and Microsoft addressed the vulnerabilities in updated Chrome and Windows versions. Chrome 153.0.8010.36 and later versions patched CVE-2026-87491, while Microsoft’s September security updates fixed CVE-2026-85880. However, the attack highlighted the risks of delayed patch adoption, with some organizations remaining vulnerable until updates were applied. securityaffairs.com reported that CVE-2026-87491 was disclosed by researcher Jihyeon Jeong from Seoul National University on August 6, 2026, and that Google awarded a $2,500 bounty for the disclosure.
Security researchers warned that the BlueMoon exploit kit could spread to other threat actors, including financially motivated groups. The exploit chain’s default configuration reflects a departure from the level of operational security and technical tradecraft typically associated with browser exploit chains,
Proofpoint said. This allows for multiple high-signal detection opportunities for endpoint security products.
proofpoint.com emphasized that the kit’s ease of adoption could lead to broader proliferation, with multiple threat actors observed using it within days of its emergence.
Unresolved Questions and Ongoing Risks
While the immediate threat of BlueMoon appears mitigated by patching, several questions remain. Who developed the exploit kit, and how did multiple threat actors gain access to it? thehackernews.com noted that the shellcode used by UTA0560 and JungleBamboo was byte-for-byte identical, suggesting the kit may have been sold or shared among Chinese-linked groups. However, Proofpoint cautioned that the exploit’s ease of adoption could lead to broader proliferation. proofpoint.com also highlighted that the kit’s code included a referenced markdown handover document and detailed debugging comments, indicating potential AI-assisted development.
Additionally, the full scope of the attacks remains unclear. Volexity reported that UTA0560 targeted NGOs on September 1, 2026, but it is unknown how many organizations were compromised. The use of a U.S. university’s website as a phishing vector also raises questions about the attackers’ targeting strategy. This pairing substantially narrows the pool of viable targets.
arstechnica.com noted that the attackers filtered out systems not using Chrome on Windows to visit the URL, further narrowing their attack surface.
As of September 15, 2026, no confirmed reports of long-term data exfiltration or system compromise beyond the initial foothold have emerged. However, the rapid deployment of BlueMoon underscores the growing threat of AI-assisted cyberattacks and the need for organizations to prioritize patch management. The backdoor provides an initial foothold on a compromised host sufficient enough for UTA0560 to survey the host, retrieve files of interest, and deploy additional tooling via the Run and Upload commands.
thehackernews.com emphasized that the exploit’s reliance on publicly available patches highlights the urgency of timely updates to close security gaps.