Cloned Websites Deliver Chrome, Windows Zero-Day Exploits

Key Takeaways

• A China-linked threat actor, UTA0565, exploited zero-day vulnerabilities in Google Chrome and Microsoft Windows using cloned websites.
• The sophisticated campaign targeted Asian government entities, likely for espionage, leveraging targeted phishing emails.
• The attack chain utilized Chrome flaws (CVE-2026-85046, CVE-2026-87491) and a Windows privilege escalation flaw (CVE-2026-85880).
• A new malware family, CLEANGULP, was deployed for post-compromise access and persistence, designed to evade detection.
• Patches for these vulnerabilities have been released; immediate updates are critical to mitigate risk.

Cybersecurity researchers have uncovered a sophisticated espionage campaign where threat actors leveraged meticulously cloned legitimate websites to deliver a chain of zero-day exploits impacting both Google Chrome and Microsoft Windows. This stealthy operation allowed attackers to compromise target systems with minimal user interaction beyond visiting a seemingly innocuous webpage.

The campaign, observed on September 3 and 4, before the vulnerabilities were publicly known and patched, specifically targeted government organizations in Asia. Attackers crafted phishing emails with lures in Chinese, referencing jailed Hong Kong activist Chow Hang-tung, and also impersonated the Center for American Progress. The intent behind these highly targeted attacks appears to be intelligence gathering rather than widespread disruption.

Security firm Volexity said in a report that it attributed this activity to a China-linked advanced persistent threat (APT) group it tracks as UTA0565. While the group utilized an exploit kit previously associated with other actors, UTA0565 refined the delivery mechanisms and payload for its specific objectives, as detailed in an accompanying detailed PDF report.

This incident underscores the persistent danger of sophisticated phishing, even for highly vigilant users. The cloned websites were convincing, often displaying genuine content from the legitimate organizations they mimicked, thereby offering few immediate visual cues of compromise.

Exploitation Chain: From Browser to System Control

Each phishing email directed victims to an attacker-controlled domain that was a near-perfect replica of a trusted website. For instance, one fraudulent domain imitated China Digital Times, while another closely mirrored the Center for American Progress. Crucially, on these fake sites, a hidden iframe loaded additional content in the background, allowing malicious code to execute without altering the user’s visible browsing experience.

This hidden component initiated a sophisticated exploit chain. It first leveraged two Google Chrome vulnerabilities, CVE-2026-85046 and CVE-2026-87491, to escape the browser’s sandbox. Following this, a Microsoft Windows privilege escalation flaw, CVE-2026-85880, was exploited to gain higher-level permissions on the compromised system. This sequential exploitation allowed the attackers to transition from a restricted browser environment to full system control.

UTA0565 adapted an existing exploit framework, integrating a new final payload and modifying supporting code. The attack chain downloaded an executable, removed its Windows “Mark-of-the-Web” internet warning, and launched it via standard Windows shell components. These modifications, including changes to variable names, debugging text, and logging options, suggest a deliberate effort to customize a shared toolkit while simultaneously complicating analysis and detection efforts.

CLEANGULP: The Post-Compromise Malware

The payload delivered by this exploit chain is a previously undocumented malware family named CLEANGULP. This malware is heavily obfuscated to hinder forensic investigation. Upon installation, it disguises itself under a name resembling legitimate Microsoft software and establishes persistence through a scheduled task.

Once active, CLEANGULP grants its operators extensive capabilities, including the ability to execute commands, enumerate processes, transfer files (upload and download), and run additional code. It communicates with a hardcoded command-and-control (C2) server over standard HTTP, encrypting its messages to blend in with normal web traffic. The use of typosquatted domains for both the initial phishing lures and the C2 infrastructure further enhances the campaign’s deceptive appearance, making it challenging for users and security systems to identify malicious activity.

What You Should Do

• Apply Updates Immediately: Ensure all Google Chrome browsers and Microsoft Windows operating systems are updated to the latest versions. These zero-day vulnerabilities have been patched.
• Hunt for Indicators of Compromise (IoCs): Review proxy, DNS, and endpoint logs for the listed IoCs. Isolate any systems exhibiting these indicators for thorough forensic investigation.
• Enhance Email Security: Implement robust email gateway rules to flag newly registered or lookalike domains. Educate staff to independently verify the legitimacy of unexpected emails, especially those with political or advocacy themes, through alternative communication channels.
• Review Browser Update Policies: Confirm that browser update policies cover all devices within your network, particularly unmanaged workstations, as these can serve as entry points for broader network compromise.
• Monitor Network Traffic: Search endpoints for suspicious host artifacts and unusual outbound connections, particularly those resembling the C2 infrastructure identified.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.