57
57
57
Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
Proofpoint reports the BlueMoon exploit kit, chaining two Chrome V8 zero-days and a Windows ALPC bug, being shared across China-linked espionage groups.
Proofpoint identified a new exploit kit, BlueMoon, first observed on August 28 and used by TA412 (APT31/Violet Typhoon) against US NGOs, mining firms, and commodity trading companies. The kit chains a V8 type confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows Advanced Local Procedure Call privilege escalation (CVE-2026-85880), both patched flaws having been exploited in the wild. At least four espionage groups, most with suspected China nexus including UNK_LateNight, adopted the kit within days, targeting US aerospace firms with defense-sector lures. Fewer than 20 organizations were observed targeted, and researchers believe AI-assisted exploit development against upstream Chromium patches enabled the kit's rapid creation and sharing.
85
China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks
Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.
Volexity documented campaigns detected on September 1, 2026, in which China-linked actors UTA0560 and JungleBamboo (APT31) chained CVE-2026-85046 (V8 type confusion), CVE-2026-87491 (WebAssembly sandbox escape), and CVE-2026-85880 (Windows kernel privilege escalation in RtlpCreateServerAcl). Victims were lured via links on legitimate U.S. university sites vulnerable to reflected XSS, then served hidden exploit iframes behind a donation-form image. Although a V8 fix had landed in Chromium's source after private August reporting, Chrome had not yet shipped it, creating a patch gap the actors exploited. The two groups installed distinct payloads: UTA0560 delivered the GRIMWEDGE JScript backdoor via DLL side-loading, while JungleBamboo used the SUPERSTOMP loader to install the LONGTALE credential-stealing Chrome extension disguised as Google Gemini.
85
⚡ Weekly Recap: Instagram Account Hacks, Android Zero
60
60
57
57
CISA adds recently disclosed Apple flaws to its Known Exploited Vulnerabilities catalog
60
57
60
57
57
57
60
57
60
57