Hackers Clone Legitimate Websites to Silently Trigger Chrome and Windows Zero-Day Exploits
A cyber campaign uses cloned legitimate websites to trigger zero-day exploits in Chrome and Windows, targeting Asian government entities for espionage.
0
Vendor
Volexity
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenAug 17, 2026
- Last mentionedSep 22, 2026
Timeline
7 articles · newest firstChina-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks
Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.
85
Attackers are weaponizing the gap between Chromium fixes and Chrome patches
Espionage actors use the BlueMoon exploit kit to chain Chrome V8 and Windows kernel zero-days via spear phishing, gaining full admin on unpatched endpoints.
82
New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws
Multiple China-linked espionage groups share the BlueMoon exploit kit chaining Chrome V8 zero-days and a Windows ALPC LPE to deploy backdoors.
85
Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days
Proofpoint reports four nation-state actors, mostly China-nexus, adopted the BlueMoon Chrome and Windows zero-day exploit kit within 12 days, targeting US organizations.
85
Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.
82
Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022
Unauthenticated Confluence RCE CVE-2022-26134 was exploited in the wild; Volexity observed intrusions and Cerber ransomware on unpatched servers.
80
Related CVEs
by mentions- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-874914%8.8Actively Exploited Out-of-Bounds Write in Google Chrome V8
- CVE-2022-26134100%9.8Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center
- CVE-2026-62895<1%8.8Permissive Cross-Domain Policy Privilege Elevation in Microsoft Azure Arc
- CVE-2026-69524<1%8.1Use-After-Free Remote Code Execution in Microsoft Active Directory Domain Services
- CVE-2026-693291%7.5Unauthenticated out-of-bounds read DoS in Microsoft Windows BranchCache
- CVE-2026-72978<1%7.5Unauthenticated DoS in Microsoft Active Directory Federation Services (AD FS)
- CVE-2026-81349<1%7.2OS Command Injection Privilege Elevation in Microsoft Azure HDInsights
- CVE-2026-69401<1%7.0Use-After-Free Local Privilege Escalation in Microsoft Windows AVCTP Component
Appears with
- Proofpointvendor · 4
- Microsoftvendor · 4
- Chromeproduct · 3
- Volexityorganization · 3
- Googlevendor · 3
- JungleBamboothreat actor · 3
- APT31threat actor · 3
- TA412threat actor · 2
- Chromiumproduct · 2
- Grimwedgemalware · 2
- Windowsproduct · 2
- Microsoft Windowsvendor · 2
- Violet Typhoonthreat actor · 2
- Google Chromevendor · 2
- UTA0560threat actor · 2
- UNK_LateNightthreat actor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.