BlueMoon Exploit Kit Chained Chrome and Windows Bugs

A newly documented exploit kit called BlueMoon is being used by multiple espionage clusters to chain recently patched vulnerabilities in Google Chrome and Microsoft Windows, according to a report from Proofpoint. The kit combines two browser bugs with a Windows local privilege escalation flaw to silently install surveillance and credential-stealing malware. The first known in-the-wild use was attributed to the China-aligned group APT31 on August 28, 2026, and within days several other clusters, most with a suspected China nexus, began using the same kit.

The exploit chain uses three vulnerabilities: CVE-2026-85046, a type confusion bug in Chrome's V8 JavaScript engine; CVE-2026-87491, an out-of-bounds bug in V8 that can lead to a sandbox escape; and CVE-2026-85880, a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC). Google patched CVE-2026-85046 last week, Microsoft fixed CVE-2026-85880 in its September 2026 Patch Tuesday updates, and Proofpoint told The Hacker News that Google released a patch for CVE-2026-87491 on September 8, 2026. Notably, both V8 flaws were "patch-gap" zero-days: they had already been fixed in the public upstream Chromium source code but had not yet reached the stable versions of Chrome and other Chromium-based browsers when attackers started using them.

Proofpoint said the exploit developer likely monitored public Chromium patches closely to assemble the browser chain before those fixes were shipped to users. Attack chains begin with phishing emails that lure targets to an actor-controlled URL. That page triggers the two V8 flaws in succession to run code and escape the browser's sandbox, then uses the Windows ALPC bug to gain higher privileges. With those privileges, a shellcode injector inserts a CreateProcess stub into the parent Chrome broker process and runs an operator-specified command; by default, the command downloads an executable using curl and runs it. Before the local privilege escalation, the kit uses a reflectively loaded DLL to fingerprint the Windows host so the exploit kit's JavaScript can decide whether to attempt that step.

Proofpoint researchers Mark Kelly, Greg Lesnewich, Konstantin Klinger, Saher Naumaan, Julia Paluch, David Galazin, and Stuart Del Caliz observed multiple variants of BlueMoon. Some variants removed comments or obfuscated components; others added campaign-specific landing pages, redirects, browser-side operating system checks, or extra telemetry, but the underlying exploit chain stayed the same. Four activity clusters are described. APT31 used spear-phishing lures against non-governmental organizations, mining companies, and physical commodity trading firms in the United States starting August 28. Its BlueMoon deployment downloaded a loader that installed a malicious browser extension disguised as Google Gemini, using a Chrome extension integrity bypass called GhostChrome-X. That extension, named GemStone, acts as a browser-surveillance and credential-theft backdoor controlled through a command-and-control (C2) channel. UNK_LateNight, a China-aligned cluster, targeted multiple U.S. aerospace companies from September 2 and used BlueMoon to deliver the ShadowPad backdoor through DLL sideloading, a technique that makes a program load a malicious helper file instead of the legitimate one. UNK_DoubleCheck targeted a Vietnamese manufacturing entity on September 2; it hosted BlueMoon on a Cloudflare Workers domain and used a DLL sideloading attack to drop a Rust binary, which then fetched and executed a second DLL sideloading pair from a Cloudflare R2 Bucket. UNK_QuietRacket, a China-aligned cluster active from September 3, targeted government, consulting, and financial sector organizations in Indonesia and Singapore. Its modified BlueMoon downloaded a DLL sideloading pair, and the rogue DLL used Cloudflare Workers domains to obtain and run a .NET assembly in memory; that in-memory payload created a scheduled task so the malware would survive reboots.

Proofpoint said the source code artifacts contain extensive logging and verbose comments that suggest the malware may have been developed with help from artificial intelligence tools. The artifacts also repeatedly reference v8CTF, an exploit-focused vulnerability reward program and capture-the-flag competition run by Google against the V8 engine. It is not known whether the V8 exploits were genuinely developed for v8CTF or whether that framing was used to bypass large language model guardrails. Proofpoint also said it is currently unknown how multiple distinct threat actors obtained access to BlueMoon. The company warned that the kit's ease of adoption makes further proliferation likely among both espionage-motivated and financially motivated actors as patched versions are fully rolled out across Chromium-based browsers. "A fully weaponized Chrome exploit chain has historically been a high-value, rare capability," Proofpoint said. "BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals." The report suggests a reduced cost and barrier to entry for this class of capability as AI agents increasingly enable threat actor exploit development, especially for open source codebases like Chromium where upstream patches are public before downstream browsers apply them.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added all three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, giving U.S. Federal Civilian Executive Branch agencies deadlines of September 18 for CVE-2026-85046, September 22 for CVE-2026-85880, and September 23 for CVE-2026-87491. However, updating the browser only closes the way in; it does not remove artifacts that have already been installed. The GemStone extension and the scheduled tasks created by other clusters survive a patch. Proofpoint listed specific signs that targeted organizations should check: a process tree showing chrome.exe starting cmd.exe, then curl.exe, then msgbox.exe; files ChromeUpdate.exe or msgbox.exe in the Windows %TEMP% folder; a folder named C:\Users\Public\stomp_ext; scheduled tasks named EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, Avpcheckup, or GeForceService; a mutex called Dataupcheckinfo; and a registry key at HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32. Proofpoint has also published detection rules for the kit's JavaScript loader and C2 traffic, numbered from Signature IDs 2071919 through 2071924.

For website owners, the exploit chain shows why client-side browser patching and host-side server patching must happen together; while AEU Hosting provides managed WordPress hosting secured end to end and can reduce server-side risk, individual visitors still need to keep their own browsers updated because this attack runs on their devices, not on the web server.