BlueMoon Exploit Kit Used by Four Spy Groups to Target Chrome and Windows

Security researchers have identified four separate threat activity clusters using essentially the same exploit chain within days of one another. The activity suggests that sophisticated browser exploitation capabilities are becoming easier for multiple threat actors to obtain and deploy.

The campaigns primarily involved suspected China-linked espionage groups, although researchers have not attributed every observed operation to a specific actor.

BlueMoon combines browser vulnerabilities with a Windows privilege-escalation flaw, allowing attackers to move from malicious web content to code execution and higher privileges on the compromised system.

BlueMoon Exploit Chain

The exploit kit was first observed in active attacks on August 28, 2026, when it was used by the China-aligned threat group APT31.

Researchers subsequently observed three additional activity clusters deploying the same framework beginning September 2 and September 3.

BlueMoon chains three vulnerabilities:

Vulnerability	Component	Description
CVE-2026-85046	Google Chrome V8	Type-confusion vulnerability
Unassigned flaw	Chrome V8	Sandbox escape vulnerability
CVE-2026-85880	Windows ALPC	Heap-based buffer overflow enabling local privilege escalation

Google addressed CVE-2026-85046 in a Chrome security update, while Microsoft patched CVE-2026-85880 through its September 2026 Patch Tuesday updates.

Patch-Gap Exploitation

One of the most notable aspects of the campaign is the way the Chrome vulnerabilities were weaponized.

Researchers described the V8 vulnerabilities as "patch-gap" zero-days at the time they were exploited. The underlying fixes had already appeared in publicly available Chromium source code, but the corresponding patches had not yet reached the latest stable versions used by Chrome and other Chromium-based browsers.

This creates a dangerous window between a vulnerability being fixed upstream and the security update reaching end users.

Threat actors can monitor public source-code changes, analyze patches and attempt to develop working exploits before downstream browser vendors distribute the fixes.

The BlueMoon activity indicates that attackers may be increasingly capable of taking advantage of this window.

How the Attack Works

The observed attacks generally begin with spear-phishing.

Victims receive a carefully crafted message containing a link that directs them to infrastructure controlled by the attacker.

Once the victim visits the malicious page, BlueMoon attempts to exploit the Chrome V8 vulnerabilities.

The attack chain broadly follows this sequence:

1. A targeted phishing message delivers a malicious URL.
2. The victim opens the attacker-controlled page in Chrome.
3. BlueMoon exploits the V8 vulnerabilities.
4. Code execution is achieved within the browser.
5. The exploit escapes Chrome's security sandbox.
6. The Windows ALPC vulnerability is exploited for privilege escalation.
7. Shellcode is injected into the Chrome process.
8. The attacker executes commands on the system.
9. Additional malware or payloads are downloaded.

The exploit kit also fingerprints the Windows environment before deciding whether to proceed with the local privilege-escalation stage.

Four Threat Clusters Linked to BlueMoon

APT31

APT31 was the first known group to deploy BlueMoon, beginning on August 28.

The campaign targeted organizations in the United States, including:

• Non-governmental organizations
• Mining companies
• Physical commodity trading firms

After successful exploitation, the attackers deployed a loader that installed a malicious Chrome extension disguised as Google Gemini.

The extension, identified as GemStone, functions as a browser surveillance and credential-theft backdoor and provides the attackers with command-and-control capabilities.

The operation also used a Chrome extension integrity bypass technique known as GhostChrome-X.

UNK_LateNight

Beginning September 2, another China-aligned activity cluster tracked as UNK_LateNight adopted BlueMoon.

The group targeted multiple U.S. aerospace organizations using spear-phishing messages.

Following exploitation, the attackers deployed the ShadowPad backdoor through DLL side-loading.

UNK_DoubleCheck

Another cluster, tracked as UNK_DoubleCheck, was observed targeting a Vietnamese manufacturing organization.

The attackers directed victims to an infrastructure hosted through Cloudflare Workers.

BlueMoon was delivered through the malicious infrastructure before the attackers used DLL side-loading to deploy a Rust-based payload.

The malware subsequently contacted a Cloudflare R2 bucket to retrieve additional components.

UNK_QuietRacket

A fourth activity cluster, UNK_QuietRacket, began using BlueMoon on September 3.

Its targets included organizations in:

• Indonesia
• Singapore

The campaign focused on government, consulting and financial-sector organizations.

In this case, BlueMoon was modified to deliver a DLL side-loading chain. The resulting malware communicated with Cloudflare Workers infrastructure and retrieved a .NET payload directly into memory.

The payload also established persistence by creating a scheduled task.

Same Exploit Chain, Different Payloads

Although the four campaigns used different malware and infrastructure, researchers found that the underlying BlueMoon exploitation mechanism remained largely consistent.

Attackers made minor modifications to the kit, including:

• Removing source-code comments
• Obfuscating components
• Changing landing pages
• Modifying redirects
• Adding browser and operating-system checks
• Implementing additional telemetry

These changes appear designed to adapt the exploit kit for individual campaigns while preserving its core exploitation capabilities.

Possible AI Assistance in Exploit Development

Researchers also identified clues suggesting that artificial intelligence may have played a role in developing or modifying portions of the exploit infrastructure.

Some source-code artifacts contained extensive logging and unusually detailed comments.

The code also repeatedly referenced v8CTF, a Google vulnerability-research and capture-the-flag program focused on the V8 JavaScript engine.

Researchers noted that it remains unclear whether the vulnerabilities were actually developed through the v8CTF program or whether references to it were deliberately included to evade safeguards imposed by AI coding systems.

The possibility nevertheless highlights a growing concern: AI-assisted development could lower the technical barrier for building sophisticated exploitation tools.

Why BlueMoon Is Significant

Fully weaponized browser exploit chains have historically been difficult and expensive to develop.

BlueMoon stands out because the same capability appeared across several threat clusters in a very short period.

Researchers believe this may indicate that advanced exploit capabilities are becoming easier to obtain, develop or share.

The availability of public Chromium patches could further accelerate this process. Attackers who closely monitor upstream fixes may have an opportunity to reverse-engineer vulnerabilities before the corresponding patches are widely deployed.

This creates a particularly important risk for organizations with large numbers of unmanaged or slow-to-update browsers.

Patching Is Only the First Step

CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4 and set a September 18 deadline for U.S. federal civilian agencies to address the vulnerability.

However, simply installing the latest Chrome update does not necessarily remove an attacker who has already compromised a system.

Malicious browser extensions, scheduled tasks and other persistence mechanisms may remain active after the original browser vulnerability has been patched.

Organizations should therefore investigate potentially targeted systems rather than relying exclusively on browser updates.

Potential Indicators of Compromise

Proofpoint identified several artifacts that organizations can investigate on potentially affected Windows systems.

Security teams should look for suspicious process chains involving:

chrome.exe → cmd.exe → curl.exe → msgbox.exe

Other reported indicators include:

• ChromeUpdate.exe or msgbox.exe in the Windows %TEMP% directory

• C:\Users\Public\stomp_ext

• Scheduled tasks named:

  • EdgeCore_AutoUpdate
  • MicrosoftEdgeUpdatesTaskMachine
  • Avpcheckup
  • GeForceService

• Mutex: Dataupcheckinfo

• Suspicious registry entry under:
  HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32

Proofpoint also published detection rules covering the BlueMoon JavaScript loader and command-and-control traffic.

Security Recommendations

Organizations should prioritize the following measures:

Update Chrome and Chromium-Based Browsers

Ensure Chrome, Edge and other Chromium-based browsers are fully patched and that enterprise update policies are functioning correctly.

Patch Windows Systems

Apply Microsoft's September 2026 security updates, particularly the fix addressing CVE-2026-85880.

Investigate Previously Targeted Users

Patching a vulnerability does not remove malware or persistence mechanisms already installed during an earlier compromise.

Monitor Browser Child Processes

Security teams should investigate unusual Chrome process relationships, particularly when browser processes spawn command shells, download utilities or unexpected executables.

Inspect Browser Extensions

Review installed extensions and investigate extensions that were not deployed through approved enterprise management mechanisms.

Hunt for Scheduled Tasks

Look for newly created or unusual scheduled tasks that launch DLLs, scripts or executables.

Monitor Cloud-Based Infrastructure

Because several campaigns used services such as Cloudflare Workers and Cloudflare R2, organizations should monitor suspicious connections to newly registered or unexpected cloud infrastructure.

Strengthen Phishing Defenses

Since the campaigns began with targeted phishing, organizations should combine email security controls with security-awareness training and browser-level protections.

The Growing Exploit Supply Chain

The BlueMoon campaign demonstrates how advanced exploitation capabilities can spread between unrelated threat actors.

Instead of every espionage group independently developing a complete Chrome-to-Windows exploit chain, multiple actors were observed using substantially similar exploitation technology within a matter of days.

This could represent a shift in the economics of cyber espionage, where sophisticated exploitation capabilities become reusable commodities rather than exclusive tools developed by individual threat groups.

If attackers can rapidly study public patches and use AI-assisted development to accelerate exploit creation, the time available for defenders to patch vulnerable software could become increasingly important.

Conclusion

The emergence of BlueMoon highlights the growing risk posed by rapidly weaponized browser vulnerabilities.

Four espionage-related threat clusters were observed using the same Chrome and Windows exploitation chain within a matter of days, with the campaigns deploying different malware and persistence mechanisms after gaining access.

The activity also demonstrates why organizations should view browser security as more than a software-update problem.

Rapid patching, endpoint monitoring, browser-extension control, phishing protection and post-exploitation threat hunting all play an important role in preventing a browser vulnerability from becoming a full system compromise.

As attackers increasingly monitor public vulnerability research and potentially leverage AI to accelerate exploit development, the gap between vulnerability disclosure, patch availability and widespread deployment is becoming an increasingly critical security battleground.