BlueMoon exploit kit turns Chrome and Windows flaws into attacks
Proofpoint documents BlueMoon exploit kit used by four espionage groups to chain Chrome V8 and Windows flaws via phishing, all now in CISA's KEV.
75
Product
BlueMoon
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 9, 2026
- Last mentionedSep 10, 2026
Timeline
3 articles · newest firstFour Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days
Proofpoint reports four nation-state actors, mostly China-nexus, adopted the BlueMoon Chrome and Windows zero-day exploit kit within 12 days, targeting US organizations.
85
4 groups caught using the same Chrome and Windows exploit kit
Proofpoint says at least four groups, some China-linked, actively share the BlueMoon kit chaining two Chromium and one Windows kernel exploit.
85
Related CVEs
by mentions- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
Appears with
- Googlevendor · 3
- Proofpointvendor · 3
- Microsoftvendor · 3
- Proofpointorganization · 2
- Chromeproduct · 2
- UNK_LateNightthreat actor · 1
- Windows 11product · 1
- Malwarebytesvendor · 1
- CISAvendor · 1
- China-linked threat actorsthreat actor · 1
- Chromiumproduct · 1
- GemStonemalware · 1
- Malwarebytesorganization · 1
- Volexityvendor · 1
- Google Chromeproduct · 1
- Windowsproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.