Hackers Clone Legitimate Websites to Silently Trigger Chrome and Windows Zero-Day Exploits

Hackers are using convincing copies of trusted websites to turn an ordinary browser visit into a full Windows compromise.

The campaign pairs targeted phishing emails with a chained set of previously unknown flaws in Google Chrome and Microsoft Windows, giving attackers a quiet path from a fake page to malware on a victim’s device.

The activity was recorded on September 3 and 4, before the affected flaws were patched. It targeted Asian government entities with a Chinese-language message about jailed Hong Kong activist Chow Hang-tung, while another lure impersonated the Center for American Progress.

The apparent goal was not mass disruption, but carefully selected access for espionage. Analysts at Volexity identified the activity as the work of a third China-linked actor they track as UTA0565.

Volexity said in a report shared with Cyber Security News (CSN) that the group used the same core exploit kit previously tied to other actors, but refined the presentation and payload delivery for its own operations.

The finding shows why polished phishing pages remain dangerous even for alert users. A page can display genuine material pulled from the real organization it imitates, leaving few obvious visual warnings.

Readers can review CSN’s Chrome zero-day vulnerability update for the wider patching context behind the browser flaw used in this campaign.

Hackers Clone Legitimate Websites

Each phishing message pointed to a domain controlled by the attackers that closely copied a legitimate site. One fraudulent page mirrored China Digital Times, and another copied most content from the Center for American Progress website.

On the latter, a hidden iframe loaded an extra page in the background, so the malicious code could run without changing what the visitor saw.

That hidden component chained Chrome flaws CVE-2026-85046 and CVE-2026-87491 with the Windows privilege-escalation flaw CVE-2026-85880.

In simple terms, the first stages broke out of browser restrictions and the final stage gave the attackers higher rights on Windows. The related BlueMoon exploit chain report explains how this class of attack can move from a browser renderer to deeper system access.

UTA0565 kept much of the existing framework but swapped in a new final payload and altered supporting code. The chain downloaded a replacement executable, stripped its Windows internet warning marker, and launched it through Windows shell components.

Changes to variable names, debugging text, and logging options suggest an effort to tailor a shared toolkit while making analysis and detection harder.

CLEANGULP Expands Post-Compromise Access

The downloaded program belongs to a previously undocumented malware family called CLEANGULP. It is heavily disguised to frustrate investigation, then installs itself under a Microsoft-looking name and creates a scheduled task for persistence.

Once active, it can run commands, list processes, upload or download files, and execute additional code supplied by its operators. CLEANGULP communicates over ordinary HTTP with a hardcoded command server, encrypting its messages before sending them.

That design can help its traffic blend into routine web activity, while the use of typo-squatted domains gives the operation a familiar appearance at both the initial phishing and later control stages.

Administrators should hunt the indicators below, review proxy and DNS logs, and isolate any affected systems for full investigation. The campaign also underlines the need to apply browser and Windows security updates quickly, especially after active exploitation is reported.

Organizations should test and deploy the relevant updates, block the listed infrastructure, and warn staff to verify unexpected advocacy or policy-themed emails through an independent channel.

CSN’s September Patch Tuesday update covers the Windows fix for CVE-2026-85880 and the urgency of remedial action. Security teams should check whether browser update policies leave unmanaged devices behind, because an unpatched workstation can provide a foothold into a larger network.

Email gateways should flag newly registered lookalike domains, while incident responders should search endpoints for listed host artifacts and suspicious outbound connections.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Spoofed domain	chinadigitaltimes[.]top	Attacker-controlled domain impersonating China Digital Times
Hosting IP address	96.9.125[.]52	Hosted a website designed to imitate China Digital Times
Spoofed domain	americanprgoress[.]top	Typosquatted domain impersonating the Center for American Progress
Malicious URL	hxxps://americanprgoress[.]top/chrome_cleanup.exe	Payload delivery location
Hidden iframe resource	/config.html	Hidden page used to load the exploit components
File name	chrome_cleanup.exe	Win64 CLEANGULP payload
File name	p1	Embedded exploit binary
File name	p2	Embedded exploit binary
MD5	177652713dad3c128bd9195abf2b7603	Hash for the payload
SHA-1	668aa5551315ab26b67118fbb29f8e4560a1e1af	Hash for the payload
SHA-256	8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb	Hash for the payload
File path	%LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe	CLEANGULP installation path
Scheduled task	MicrosoftIME	Persistence mechanism used by CLEANGULP
C2 domain	thecovnresation[.]com	Hardcoded CLEANGULP command-and-control server
C2 endpoint	http://thecovnresation[.]com/beacon/pre-register	Initial malware registration path
Encryption key hash	cbeeb7dd5e89261cde032825fd10bb80bad2e3fbf5b91fdc9137ad463ffa8f21	SHA-256 value used to derive the AES key
Suspected attacker domain	personclouds[.]com	Additional domain assessed as linked to UTA0565 activity
Suspected attacker domain	outsourcingwise[.]net	Typosquatted infrastructure linked to similar campaigns
Suspected attacker domain	halal-navi[.]net	Typosquatted infrastructure linked to similar campaigns
Suspected attacker domain	halaltak[.]net	Typosquatted infrastructure linked to similar campaigns
Suspected attacker domain	thecovnresation[.]net	Additional typosquatted domain resembling The Conversation
Suspected attacker domain	borneobulletins[.]top	Typosquatted infrastructure linked to similar campaigns

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC