BlueMoon Exploit Kit Chains Chrome, Windows Zero-Days in Attacks

Key Takeaways

• A newly identified exploit kit, dubbed “BlueMoon,” is actively being used by state-aligned threat actors, primarily linked to China.
• BlueMoon chains together three zero-day vulnerabilities: two in Chrome’s V8 JavaScript engine (CVE-2026-85046) and one in the Windows kernel (CVE-2026-85880).
• The exploit kit targets government, defense, and commercial entities globally, deploying backdoors and surveillance tools.
• Both Chrome vulnerabilities were “patch-gap” zero-days, exploited before stable browser releases received fixes.
• While effective, the exploit chain shows signs of hasty development and only works on older Windows builds, suggesting a rapid adoption cycle.

A sophisticated exploit kit, named “BlueMoon” by security researchers, has been rapidly adopted by multiple espionage-focused threat groups to target government, defense, and commercial organizations worldwide. This kit leverages a chain of zero-day vulnerabilities in both the Chrome browser and Microsoft Windows to install persistent backdoors and advanced surveillance tools.

Proofpoint’s analysis reveals that at least four distinct threat clusters have utilized BlueMoon since late August 2026, with most exhibiting suspected ties to China. The initial confirmed deployment was observed on August 28, 2026, by TA412, also known as Violet Typhoon or APT31. Other groups quickly integrated the same capabilities into their operations within a matter of days.

BlueMoon Exploit Chain Mechanics

The BlueMoon exploit chain is a three-stage attack, beginning with a critical vulnerability in Chromium’s V8 JavaScript engine. This flaw, identified as CVE-2026-85046, is a type-confusion bug that allows remote code execution within the browser’s renderer. It achieves this by exploiting an optimization defect in V8’s JIT compiler.

Following the initial browser compromise, the exploit executes a V8 sandbox escape. This stage corrupts WebAssembly module metadata, enabling the attackers to overwrite compiled function bodies with their own malicious shellcode.

The final step involves a local privilege escalation vulnerability within the Windows kernel, tracked as CVE-2026-85880. This flaw exploits Advanced Local Procedure Call (ALPC) and Windows Notification Facility (WNF) mechanisms to gain kernel read/write access and elevate privileges from within the compromised browser process.

Intriguingly, both Chrome-side vulnerabilities were “patch-gap” zero-days. This means that while fixes had already been committed to Chromium’s public source code, they had not yet been deployed to stable browser releases. This provided the exploit developers with approximately a four-week window to reverse-engineer a functional exploit before end-users received the patches.

Operational Characteristics and Development Insights

Researchers at Proofpoint noted several indicators suggesting that BlueMoon was deployed quickly rather than being the culmination of a long-term, meticulously planned operation. For instance, the Windows privilege escalation component is only effective against older builds, specifically Windows 10 and Server 2019/2022, which significantly narrows the range of potential targets. Furthermore, the infrastructure used to deliver the exploits was frequently registered on the very same day as each campaign, indicating a rapid setup and deployment cycle.

Uncharacteristically for a browser exploit chain, the default payload delivers a simple curl command to download and execute an attacker-supplied file. This method offers minimal operational stealth and presents numerous opportunities for detection by endpoint security solutions.

Proofpoint also highlighted circumstantial evidence pointing towards AI-assisted development of the exploit. This included extensive diagnostic logging, verbose debugging comments, and a referenced markdown “handover” document, all consistent with artifacts often generated by AI coding agents. The code also contained references to Google’s v8CTF bug bounty framework, though it remains unclear whether this signifies legitimate bounty research or an attempt to circumvent AI model safety guardrails.

Targeted Campaigns and Delivered Payloads

TA412 employed spearphishing tactics, impersonating university interns and academic conference outreach, to target US non-governmental organizations (NGOs), mining firms, and commodity trading companies. These campaigns ultimately installed a malicious browser extension disguised as “Google Gemini,” which Proofpoint tracks as GemStone. This extension functions as a comprehensive browser-surveillance backdoor, capable of keylogging, cookie theft, screenshot capture, and executing arbitrary HTTP requests via its command-and-control infrastructure.

A separate threat cluster, designated UNK_LateNight, focused on US aerospace companies. They used defense-themed procurement lures to deliver the ShadowPad backdoor through a DLL-sideloading chain.

Another group, UNK_DoubleCheck, compromised a Southeast Asian government email account to target a Vietnamese manufacturer with a Rust-based loader. Concurrently, UNK_QuietRacket launched conference-themed phishing attacks against government and financial organizations in Indonesia and Singapore, utilizing DNS-over-HTTPS-based command channels.

Proofpoint’s research suggests that the historical barrier to developing fully weaponized browser exploit chains, traditionally a rare and costly endeavor, may be diminishing. This shift is likely due to the acceleration of exploit development against open-source codebases like Chromium, facilitated by AI-assisted tooling.

The rapid adoption of the BlueMoon kit by multiple distinct threat actors within days raises significant questions about a potential shared procurement pipeline or “digital quartermaster” model. This pattern mirrors previous instances of widespread exploitation, such as those seen with Microsoft Exchange and SharePoint vulnerabilities.

What You Should Do

• Patch Immediately: Ensure all Chromium-based browsers (Chrome, Edge, Brave, Opera, etc.) and Microsoft Windows operating systems are updated to their latest stable versions. Prioritize patches for CVE-2026-85046 and CVE-2026-85880.
• Prioritize Older Systems: Organizations still running older Windows builds (Windows 10, Server 2019/2022) should be especially vigilant and consider upgrading or isolating these systems if patching is not immediately feasible.
• Enhance Email Security: Implement advanced email filtering and anti-phishing solutions to detect and block spearphishing attempts, which are a primary delivery vector for BlueMoon.
• Educate Users: Conduct regular cybersecurity awareness training for employees, emphasizing the dangers of clicking suspicious links, opening unexpected attachments, and falling for social engineering tactics.
• Deploy Endpoint Detection and Response (EDR): Utilize EDR solutions to monitor for suspicious activities, such as unusual curl commands, unexpected browser extensions, and privilege escalation attempts, which can help detect BlueMoon activity.
• Monitor Network Traffic: Implement network intrusion detection systems (NIDS) to identify unusual DNS-over-HTTPS traffic or connections to known command-and-control infrastructure.
• Review Browser Extensions: Regularly audit and remove unnecessary or suspicious browser extensions. Implement policies to restrict the installation of unauthorized extensions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.