BlueMoon exploit kit turns Chrome and Windows flaws into attacks
Proofpoint documents BlueMoon exploit kit used by four espionage groups to chain Chrome V8 and Windows flaws via phishing, all now in CISA's KEV.
Proofpoint identified a shared Chrome and Windows exploit kit, BlueMoon, used by four espionage groups against Chrome on Windows within days of one another. Attacks began with phishing emails leading to web pages that exploited two Chrome V8 vulnerabilities, followed by a Windows flaw to escape browser protections and gain higher privileges. The Chrome flaws were patched in Stable on September 3 and 8, 2026, the Windows flaw was fixed in September Patch Tuesday, and all three were actively exploited and added to CISA's KEV catalog. Researchers found clues, but no conclusive evidence, that the kit was developed with AI assistance.
- Four espionage groups used the same Chrome-plus-Windows exploit chain
- Attacks started with phishing emails linking to exploit pages
- All three exploited flaws were added to CISA's KEV catalog
- Publicly visible upstream fixes may let attackers weaponize chains faster
- Clues, but no proof, of AI-assisted exploit kit development
- ATT&CK
- T1566.002 Spearphishing LinkT1203 Exploitation for Client ExecutionT1068 Exploitation for Privilege Escalation
- Organizations
- ProofpointGoogleMicrosoftCISAMalwarebytes
From the original article
2 min read at malwarebytes.com
Four different espionage groups used the same exploit kit to target recently fixed flaws, showing why “patch later” is a dangerous gamble.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.