Four espionage groups used the same exploit kit against Chrome and Windows within one week, turning a patch gap into a live attack window across the US and Southeast Asia.
Proofpoint tracks the toolkit as BlueMoon, which chains two Chromium V8 flaws with a Windows privilege-escalation bug to escape the browser sandbox and run malware with elevated rights. Targets included US NGOs, mining and commodity firms, aerospace companies, a Vietnamese manufacturer, and government, consulting, and financial organizations in Singapore and Indonesia.
All three vulnerabilities are now patched, but compromised systems may still contain malware or persistence mechanisms.
The speed of adoption is a warning for defenders. Separate espionage groups moved to nearly identical exploit code within days, leaving organizations little time between disclosure of a fix and active exploitation.
BlueMoon chains Chrome and Windows flaws
According to Proofpoint, BlueMoon combines CVE-2026-85046, a V8 type confusion flaw, with CVE-2026-87491, a second V8 vulnerability used to escape Chrome’s sandbox. Attackers then exploit CVE-2026-85880, a Windows privilege-escalation flaw, to gain higher permissions on the system.
The attacks start with phishing emails that direct targets to attacker-controlled websites. Once the browser exploits succeed, BlueMoon checks the Windows host and can use the Windows flaw to elevate privileges before downloading operator-selected malware.
The two Chrome vulnerabilities were considered “patch-gap” zero-days during the attacks. Ars Technica reported that the flaws had already been fixed in public Chromium source code, but the fixes had not yet reached stable Chrome and other Chromium-based browsers.
Four campaigns adopted BlueMoon within days
The Hacker News said that TA412, also tracked as APT31, was the first group Proofpoint observed using BlueMoon on Aug. 28. It targeted US NGOs, mining companies, and commodity trading firms and installed GemStone, a malicious Chrome extension disguised as Google’s Gemini AI assistant.
UNK_LateNight began using BlueMoon on Sept. 2 against US aerospace companies and deployed the ShadowPad backdoor. UNK_DoubleCheck targeted a Vietnamese manufacturer, while China-aligned UNK_QuietRacket targeted government, consulting, and financial organizations in Indonesia and Singapore.
The campaigns had different targets, malware, and command-and-control infrastructure, yet their BlueMoon code was nearly identical. “There’s no way that this is parallel development,” Proofpoint researcher Mark Kelly told The Record.
Researchers could not determine whether the groups received the kit from a common contractor, a state-linked source, or another shared channel.
Proofpoint also found extensive logging and development comments that could point to AI-assisted exploit development. Researchers did not establish that AI was definitely used, but warned that AI tools may make it faster to study public patches and turn them into working exploits.
The Hacker News noted that CISA added all three BlueMoon vulnerabilities to its Known Exploited Vulnerabilities catalog. Federal civilian agencies were given September deadlines to remediate the flaws.
Updating vulnerable Chrome, Chromium-based browsers, and Windows systems closes the known exploit path. Patching alone, however, does not remove malware or persistence mechanisms already installed before the update.
Security teams investigating possible exposure can look for indicators identified by Proofpoint:
- chrome.exe spawning cmd.exe, followed by curl.exe and msgbox.exe
- ChromeUpdate.exe or msgbox.exe in %TEMP%, along with the C:\Users\Public\stomp_ext folder
- Scheduled tasks including EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, Avpcheckup, or GeForceService
Proofpoint also published detection rules for BlueMoon’s JavaScript loader and command-and-control traffic. The firm expects the kit to reach more espionage and financially motivated threat actors, so organizations that may have been targeted should pair rapid patching with endpoint checks for an earlier compromise.
For another look at browser-based threats, read how PEEP turns Chrome and Edge into post-compromise backdoors for credential theft, session hijacking, and host command execution.