Multiple cyberespionage groups, primarily those with suspected ties to China, have been observed deploying a new exploit kit, dubbed "BlueMoon," which chains together three vulnerabilities in Chromium-based browsers and Microsoft Windows. The kit was first detected in late August and has since been used to target fewer than 20 organizations globally, though the actual number is likely higher.
The BlueMoon exploit kit leverages a V8 type confusion flaw (CVE-2026-85046) affecting all Chromium-based browsers, a Chrome V8 sandbox escape vulnerability that does not have a CVE identifier, and a privilege escalation vulnerability in Windows Advanced Local Procedure Call (CVE-2026-85880). Google patched CVE-2026-85046 in Chrome on September 3, and Microsoft addressed the same flaw in Edge Stable version 152.0.4191.62 on September 2. Microsoft released a patch for CVE-2026-85880 on Tuesday, confirming it had been exploited as a zero-day prior to the update.
Security researchers noted that both V8 vulnerabilities were "patch-gap" zero-days at the time of the observed attacks. This means fixes for these flaws were committed to the upstream Chromium source code, with the patch for CVE-2026-85046 committed on August 7, but they remained unpatched in stable public releases of Chrome and other Chromium-based browsers for several weeks. It is believed that the exploit kit developers utilized these publicly available Chromium patches to create the browser exploit chain.
The attack sequence typically begins with a phishing email that directs victims to an attacker-controlled URL. This triggers the two V8 vulnerabilities, enabling remote code execution and a browser sandbox escape. Subsequently, the Windows privilege escalation bug is exploited to download various payloads, which can include browser-surveillance malware, credential-stealing backdoors, and other malicious tools, depending on the specific threat actor.
The first observed campaign, starting August 28, involved a Beijing-backed group tracked as TA412 (also known as Violet Typhoon and APT31). This group, linked by US authorities to China's Ministry of State Security (MSS), repeatedly targeted non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the US. Their phishing lures included emails purporting to be from university students seeking internships or more tailored exchanges designed to build trust before delivering a malicious link.
In TA412's attacks, the exploit chain ultimately downloaded and executed a loader that installed a malicious browser extension, tracked as GemStone, disguised as Google Gemini on the victim's Chromium-based browser. GemStone allowed the attackers to issue commands via a command-and-control (C&C) channel, steal cookies and other sensitive data, capture screenshots, inject a keylogger into browser tabs, and monitor for specific keywords within HTML content, triggering a screenshot if found.
Days later, on September 2, a second China-aligned group, temporarily designated UNK_LateNight, used BlueMoon to target multiple US aerospace companies. Their phishing emails employed request-for-quotation lures specific to the defense industry, leading to attacker-controlled domains spoofing legitimate US aerospace firms. These websites served the BlueMoon exploit kit and ultimately deployed ShadowPad, a backdoor previously shared among several China-aligned groups since 2019.
Around the same time, another suspected espionage group, UNK_DoubleCheck, targeted a Vietnamese manufacturing firm with messages sent from a compromised Southeast Asian government email address. A fourth campaign began on September 3, with the suspected China-linked group UNK_QuietRacket using BlueMoon against government, consulting, and financial-sector organizations in Indonesia and Singapore. These attacks used lures related to Indonesian conferences, such as the Indo Startup Expo and Forum 2026 and the World Conference on Creative Economy (WCCE 2026).
Researchers anticipate that BlueMoon will likely be adopted by both cyberespionage and financially motivated attackers. The rapid development and sharing of this exploit kit among multiple threat actors within days suggest a reduced cost and barrier to entry for such capabilities. This trend may be influenced by AI agents facilitating exploit development, particularly for open-source codebases like Chromium, where publicly accessible upstream patches create a window for rapid reverse engineering and exploit creation before stable releases are widely available.
