Hackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks

Multiple espionage-motivated threat actors have rapidly adopted a newly discovered exploit kit that chains Chrome browser and Microsoft Windows vulnerabilities to deploy backdoors and surveillance tools against government, defense, and commercial targets worldwide.

Security researchers at Proofpoint have named the kit “BlueMoon,” identifying its use by at least four distinct threat clusters since late August 2026, with the majority showing a suspected China nexus.

The first confirmed use came from TA412, also known as Violet Typhoon or APT31, on 28 August 2026, with additional groups adopting the same capability within days.

BlueMoon Exploit Chain

BlueMoon exploits three vulnerabilities in sequence. The first is a type-confusion flaw in Chromium’s V8 JavaScript engine, tracked as CVE-2026-85046, which enables remote code execution inside the browser renderer by abusing an optimization bug in V8’s JIT compiler.

This is followed by a V8 sandbox escape that corrupts WebAssembly module metadata to overwrite compiled function bodies with attacker shellcode.

The final stage leverages a Windows kernel local privilege escalation flaw, CVE-2026-85880, which uses Advanced Local Procedure Call and Windows Notification Facility mechanisms to gain kernel read/write access and elevate privileges within the browser process.

Notably, both Chrome-side vulnerabilities were “patch-gap” zero-days, meaning the fixes already existed in Chromium’s public source code but had not yet rolled out to stable browser releases, giving the exploit developer roughly a four-week window to reverse-engineer a working exploit before patches reached end users.

Proofpoint researchers noted several signs that BlueMoon was deployed hastily rather than as a mature, long-planned operation. The Windows privilege escalation only works on older builds such as Windows 10 and Server 2019/2022, narrowing viable targets considerably, while the infrastructure used to deliver the exploits was frequently registered the same day as each campaign.

Unusually for a browser exploit chain, the default payload behavior is a simple curl command that downloads and executes an attacker-supplied file, an approach that offers little operational stealth and creates multiple detection opportunities for endpoint security tools.

Researchers also flagged circumstantial evidence pointing toward AI-assisted development, including extensive diagnostic logging, verbose debugging comments, and a referenced markdown “handover” document consistent with artifacts left behind by AI coding agents.

References to Google’s v8CTF bug bounty framework appear throughout the code, though researchers are uncertain whether this reflects genuine bounty research or an attempt to bypass AI model safety guardrails.

TA412 used spearphishing lures posing as university interns and academic conference outreach to target US NGOs, mining firms, and commodity trading companies, ultimately installing a malicious browser extension disguised as “Google Gemini” that Proofpoint tracks as GemStone.

The extension functions as a full browser-surveillance backdoor capable of keylogging, cookie theft, screenshot capture, and arbitrary HTTP requests via command-and-control infrastructure.

A separate cluster dubbed UNK_LateNight targeted US aerospace companies with defense-themed procurement lures, delivering the ShadowPad backdoor through a DLL-sideloading chain, Proofpoint noted.

Another group, UNK_DoubleCheck, compromised a Southeast Asian government email account to target a Vietnamese manufacturer with a Rust-based loader, while UNK_QuietRacket targeted government and financial organizations in Indonesia and Singapore using conference-themed phishing and DNS-over-HTTPS-based command channels.

Proofpoint’s findings suggest that the barrier to developing fully weaponized browser exploit chains, historically a rare and expensive capability, may be falling as AI-assisted tooling accelerates exploit development against open-source codebases like Chromium.

The speed at which multiple distinct threat actors gained access to the same kit within days raises questions about a shared procurement pipeline or “digital quartermaster” model, echoing past patterns seen in mass exploitation of Microsoft Exchange and SharePoint vulnerabilities.

Organizations running outdated Windows builds alongside unpatched Chromium-based browsers face the highest exposure, and researchers expect BlueMoon or similar patch-gap exploitation techniques to proliferate further among both espionage and financially motivated actors.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.