Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
Chinese actor UTA0565 chains three Chrome and Windows zero-days via fake NGO media sites to drop CLEANGULP backdoor malware on Asian government targets.
Volexity detected attacks on September 3-4, 2026 in which UTA0565 chained Chrome flaws CVE-2026-85046 and CVE-2026-87491 with Windows ALPC bug CVE-2026-85880 to escape the browser sandbox and gain remote code execution. Phishing emails impersonating the Center for American Progress and themed around Hong Kong activist Chow Hang-tung targeted Asian government entities, luring victims to spoofed domains loading the BlueMoon exploit kit via hidden iframe. The final shellcode dropped CLEANGULP, an MSVC-built implant with shell, process listing, upload, download, and BOF execution capabilities, using thecovnresation[.]com for HTTP command-and-control. Volexity believes the shared exploit kit reflects coordinated use across multiple Chinese CNE groups with broader impact than currently observed.
- Zero-day chain: CVE-2026-85046, CVE-2026-87491 (Chrome) plus CVE-2026-85880 (Windows ALPC).
- Spoofed China Digital Times and Center for American Progress sites delivered BlueMoon exploit kit.
- CLEANGULP supports shell, process listing, file transfer, and beacon object file execution.
- Volexity assesses the exploit kit is shared across multiple Chinese threat groups.
- Organizations
- UTA0565VolexityGoogle ChromeMicrosoft Windows
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
| CVE-2026-85880 | Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation | 7.8 | <1% | KEV | KEV |
| CVE-2026-87491 | Actively Exploited Out-of-Bounds Write in Google Chrome V8 | 8.8 | 4% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | americanprgoress.top | ed spoofed links pointing to "chinadigitaltimes[.]top" and "americanprgoress[.]top," which replicated the look of China Digital Times and CA |
| domain | chinadigitaltimes.top | month. These messages contained spoofed links pointing to "chinadigitaltimes[.]top" and "americanprgoress[.]top," which replicated the look |
| domain | theconversation.com | nd-control (C2) over HTTP, indicating an attempt to mimic " theconversation[.]com ," a non-profit media outlet known for publishing academi |
| domain | thecovnresation.com | CLEANGULP has been found to use a hard-coded domain named "thecovnresation[.]com" for command-and-control (C2) over HTTP, indicating an at |
From the original article
2 min read at thehackernews.com
A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.