Skip to content
OriginalSign in
Image: Malwarebytes

Malwarebytes

BlueMoon Exploit Kit Targets Newly Fixed Chrome and Windows Flaws

Part of the BlueMoon story · since 9 Sep

Quiet for 6 weekslast report 14 Sep7 articles6 outlets
9 Sep · SecurityOnline first6 Oct15 OctNowThis article7th of 7
  • Wed 9 Sep, 12:26 UTC. SecurityOnline, first report. Chinese-Linked Spies Exploit Chrome and Windows Zero-Days. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 20:00 UTC. The Hacker News, its first report on the story. Chrome Zero-Day Chain BlueMoon Drops Espionage Backdoors on Windows. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 21:06 UTC. Ars Technica, its first report on the story. BlueMoon Exploit Kit Races to Exploit Fresh Chrome and Windows Flaws. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 07:00 UTC. Security Affairs, its first report on the story. Chrome and Windows Zero Days Fuel BlueMoon Espionage Campaigns. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 16:12 UTC. Malwarebytes, its first report on the story. BlueMoon Exploit Kit Chains Chrome and Windows Flaws in Espionage Campaigns.
  • Sat 12 Sep, 11:30 UTC. SecurityWeek, its first report on the story. Chrome Zero Days Fuel BlueMoon Exploit Kit’s Espionage Surge. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 07:16 UTC. Malwarebytes. BlueMoon Exploit Kit Targets Newly Fixed Chrome and Windows Flaws. This article, 7th of 7.

Malwarebytes’ weekly round-up for 7–13 September 2026 highlighted several major cybersecurity developments. These included scammers targeting cryptocurrency customers after a breach at an email-marketing provider, Android malware creating hidden copies of banking apps, and the BlueMoon exploit kit using Chrome and Windows vulnerabilities in attacks. The publication said four espionage groups had used the same kit against recently fixed flaws, underscoring the risks of delaying patches.

Other reports covered an actively exploited Chrome vulnerability, Microsoft’s September 2026 Patch Tuesday, and a record 964 fixes, including two exploited zero-days. Malwarebytes also reported MikroTik router flaws that could allow takeover without a password, and LG television vulnerabilities that might let attackers listen in, including while devices were in standby mode. The round-up did not provide the CVE numbers, affected versions, exploitation details or mitigation steps for these issues.

The week’s scam and privacy coverage included a campaign involving more than 100,000 fake online shops designed to steal payment-card details and one-time banking confirmation codes, as well as copyright scams that allegedly caused Instagram accounts to be suspended before demanding payment. It also mentioned a $35 million settlement concerning Grindr’s sharing of HIV-status data and research suggesting some flirtatious OnlyFans promoters on X may use artificial intelligence to appear human.

How the story developed

All 7 articles
Quiet for 6 weekslast report 14 Sep7 articles6 outlets

7 articles from 6 outlets since 9 Sep. Quiet since 14 Sep. This was the 7th report, 5 days after the first.

Now9 Sep1011121314First reportSecurityOnline · 9 Sep, 12:26This article7th of 7 · day 5
  • Wed 9 Sep, 12:26 UTC. SecurityOnline, first report. Chinese-Linked Spies Exploit Chrome and Windows Zero-Days. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 20:00 UTC. The Hacker News, its first report on the story. Chrome Zero-Day Chain BlueMoon Drops Espionage Backdoors on Windows. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 21:06 UTC. Ars Technica, its first report on the story. BlueMoon Exploit Kit Races to Exploit Fresh Chrome and Windows Flaws. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 07:00 UTC. Security Affairs, its first report on the story. Chrome and Windows Zero Days Fuel BlueMoon Espionage Campaigns. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 16:12 UTC. Malwarebytes, its first report on the story. BlueMoon Exploit Kit Chains Chrome and Windows Flaws in Espionage Campaigns.
  • Sat 12 Sep, 11:30 UTC. SecurityWeek, its first report on the story. Chrome Zero Days Fuel BlueMoon Exploit Kit’s Espionage Surge. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 07:16 UTC. Malwarebytes. BlueMoon Exploit Kit Targets Newly Fixed Chrome and Windows Flaws. This article, 7th of 7.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 7 articles as a list
  1. Wed 9 SepDay 03
    1. Chinese-Linked Spies Exploit Chrome and Windows Zero-Days12:26 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Chrome Zero-Day Chain BlueMoon Drops Espionage Backdoors on Windows20:00 · The Hacker News · Known exploited CVE
    3. BlueMoon Exploit Kit Races to Exploit Fresh Chrome and Windows Flaws21:06 · Ars Technica · Known exploited CVE
  2. Thu 10 SepDay 12
    1. Chrome and Windows Zero Days Fuel BlueMoon Espionage Campaigns07:00 · Security Affairs · Known exploited CVE
    2. BlueMoon Exploit Kit Chains Chrome and Windows Flaws in Espionage Campaigns16:12 · Malwarebytes

  3. Quiet for 2 days

    Sat 12 SepDay 31
    1. Chrome Zero Days Fuel BlueMoon Exploit Kit’s Espionage Surge11:30 · SecurityWeek · Known exploited CVE

  4. Quiet for 2 days

    Mon 14 SepDay 51
    1. BlueMoon Exploit Kit Targets Newly Fixed Chrome and Windows Flaws07:16 · Malwarebytes · This article, 7th of 7

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in