TL;DR
- what: A previously undocumented exploit kit called BlueMoon chains two Google Chrome V8 vulnerabilities and one Windows ALPC privilege escalation bug into a single click-to-execution path, and four espionage clusters adopted it between August 28 and September 3, 2026.
- impact: A single click on a phishing link gives the operator code execution outside the Chrome sandbox with elevated privileges, followed by cluster-specific payloads including ShadowPad, a Rust loader, and a credential-stealing Chrome extension named GemStone that poses as Google Gemini.
- fix: Force Chrome to the current stable channel to close CVE-2026-85046 and the unnamed V8 sandbox escape, and install the Microsoft September 2026 Patch Tuesday updates to close CVE-2026-85880 in Advanced Local Procedure Call.
- who: Confirmed targeting hit U.S. NGOs, mining and commodity trading firms, U.S. aerospace companies, a Vietnamese manufacturer, and government, consulting, and financial organizations in Indonesia and Singapore.
Between August 28 and September 3, 2026, four separate espionage clusters ran the same exploit kit. Proofpoint published the details today and named it BlueMoon. It chains two Google Chrome V8 vulnerabilities and one Windows privilege escalation bug into a single path that starts with a click on a phishing link and ends with an operator-chosen command running outside the browser sandbox. Two of the three bugs were patch-gap zero-days: already fixed in public upstream Chromium source, not yet shipped to stable Chrome.
The speed is the part that should reset your assumptions. A capability that historically stayed inside one state-aligned group for months moved to four distinct clusters in six days, with the majority assessed as China nexus and at least some usage unattributed.
The chain
BlueMoon uses three vulnerabilities in sequence. The first two are in V8, Chrome's JavaScript engine, and run back to back from an actor-controlled landing page. The third is in Windows.
- CVE-2026-85046, a type confusion in V8 in Google Chrome, patched by Google in the week before the report.
- A V8 sandbox escape with no assigned CVE identifier, used to break out of the V8 sandbox after the type confusion lands.
- CVE-2026-85880, a heap-based buffer overflow in the Windows Advanced Local Procedure Call subsystem, addressed by Microsoft in the September 2026 Patch Tuesday release.
After the browser exploits succeed, the kit reflectively loads a DLL that fingerprints the Windows host. The kit's JavaScript reads that fingerprint and decides whether the local privilege escalation attempt is worth making. If yes, a second reflectively loaded DLL runs the ALPC exploit to elevate the Chrome renderer process. A separate injector shellcode then pushes a CreateProcess stub into the parent Chrome broker process and executes whatever command the operator configured. The default command pulls a remotely hosted executable with curl and runs it.
That default matters for detection. A curl process whose parent is chrome.exe is not normal on a corporate endpoint, and it is the cheapest observable in this entire chain.
⚠️ Patch-gap means your Chrome version was current and still vulnerable — Both V8 bugs were fixed in public Chromium source before they were used in the wild. The exploit developer appears to have been reading upstream Chromium commits and building against fixes that had not propagated to stable releases. If you rely on Chrome auto-update alone, there is a window where the fix is public, the exploit is trivially derivable, and your fleet is still running the vulnerable binary. Chromium-based browsers that lag upstream, including Edge, Brave, and Opera builds, widen that window further.
Four operators, four payload sets
The exploit chain stayed constant across every cluster. What changed was the landing page, the obfuscation, and everything after the injector.
- APT31, starting August 28, 2026. Also tracked as Bronze Vinewood, Judgement Panda, Violet Typhoon, and TA412. Spear-phished U.S. NGOs, mining companies, and physical commodity trading firms. Delivered a loader that installs a browser add-on disguised as Google Gemini, using a Chrome extension integrity bypass called GhostChrome-X. The extension, GemStone, is a browser surveillance and credential theft backdoor with its own C2 channel.
- UNK_LateNight, starting September 2, 2026. China-aligned. Targeted multiple U.S. aerospace companies and deployed the ShadowPad backdoor via DLL sideloading.
- UNK_DoubleCheck, starting September 2, 2026. Targeted a Vietnamese manufacturing entity from a Cloudflare Workers domain, sideloaded a DLL to drop a Rust binary, which then pulled a second sideloading pair from a Cloudflare R2 bucket.
- UNK_QuietRacket, starting September 3, 2026. China-aligned. Targeted government, consulting, and financial organizations in Indonesia and Singapore. Its modified kit downloads a DLL sideloading pair; the rogue DLL fetches a .NET assembly from Cloudflare Workers domains, runs it in memory, and the assembly creates a scheduled task to re-launch the sideloading sequence for persistence.
Three of the four route command and control through Cloudflare Workers or R2. That is deliberate: the traffic terminates on infrastructure most organizations cannot block wholesale, and the certificate and domain reputation are clean by default.
The AI question
Proofpoint noted extensive logging and verbose comments in the source artifacts, which is atypical for operational offensive tooling and consistent with AI-assisted development. The code also repeatedly references v8CTF, Google's exploit-focused vulnerability reward and capture-the-flag program for the V8 engine. Proofpoint states plainly that it does not know whether the exploits were genuinely built for the v8CTF bounty framework or whether that framing was used to talk a large language model past its guardrails. Either reading is worth your attention: a legitimate bug bounty pipeline feeding an espionage kit, or a working technique for laundering exploit development through a commercial model.
What to do this week
The immediate work is version enforcement, not threat hunting. Both halves of the chain now have patches available.
defaults read "/Applications/Google Chrome.app/Contents/Info.plist" CFBundleShortVersionString
find ~/Library/Application\ Support/Google/Chrome -maxdepth 3 -name Extensions -type d
grep -rl "Gemini" ~/Library/Application\ Support/Google/Chrome/*/Extensions 2>/dev/null
Chrome version compliance is now a control, not a hygiene metric — Set an enforced minimum Chrome version through policy and report on it daily. On Windows use the Chrome ADMX and the RelaunchNotificationPeriod plus RelaunchWindow keys so pending updates actually apply instead of waiting for a user to restart the browser. A patched binary sitting on disk behind a browser that has been open for eleven days is not a patched browser.
Where this goes
Proofpoint says it does not know how four distinct actors obtained the same kit. Shared vendor, shared quartermaster, and leak are all live options, and the report does not pick one. What the report does say is that BlueMoon is easy to adopt and likely to proliferate to financially motivated actors as the patches roll out across all Chromium-based browsers. That is the pattern: the patch window closes for well-run enterprises, the kit gets recycled downstream, and the long tail of unmanaged and slow-updating browsers absorbs the rest of its useful life. Hunt for the curl-from-chrome.exe lineage now, because that observable survives the exploit chain going stale.
Originally published on RedEye Threat Intelligence.
Top comments (0)