Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

Chrome Zero Days Fuel BlueMoon Exploit Kit’s Espionage Surge

Part of the CVE-2026-85046 story · since 3 Sep

Quiet for 5 weekslast report 24 Sep26 articles6 outlets
3 Sep · SecurityOnline first4 Oct14 OctNowThis article24th of 26
  • Thu 3 Sep, 23:25 UTC. SecurityOnline, first report. Google Rushes Out Chrome Patch for Exploited V8 Zero Day. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 04:35 UTC. SecurityOnline. OpenAI Drops Long Context Charges for GPT-6 Astra in Codex. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 08:41 UTC. The Hacker News, its first report on the story. Google Patches Chrome Zero Day Exploited in V8 Attacks. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:16 UTC. SecurityOnline. Sneaky 2FA Phishing Campaign Targets Healthcare with AiTM Attacks. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:16 UTC. SecurityOnline. Microsoft Teams Vishing Campaign Tricks 150 Workers Into Malware Attacks. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:16 UTC. SecurityOnline. AWS Root Accounts Hit in Password Spraying Campaign Across 150 Firms. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:51 UTC. Security Affairs, its first report on the story. Google Patches Actively Exploited Chrome V8 Zero Day. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 11:35 UTC. SecurityOnline. FreeSWITCH api-chat Flaw Exploited via SIP Messages on FusionPBX. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 11:36 UTC. SecurityOnline. Trezor Warns 80,000 Customers After ShipMonk Data Breach. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 12:10 UTC. SecurityWeek, its first report on the story. Google Patches Chrome V8 Zero Day Exploited in the Wild. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 19:11 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Google Chrome V8 Flaw as High Risk. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 21:01 UTC. CISA. CISA Warns of Actively Exploited Chromium Flaw Allowing Code Execution. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 21:01 UTC. CISA. CISA Flags Chrome V8 Flaw Affecting Major Chromium Browsers. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 23:57 UTC. Security Affairs. CISA Flags Actively Exploited Chrome Flaw as Sixth 2026 Zero-Day. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 11:46 UTC. SecurityOnline. Google Expands Gemini Live Voice Features Across Workspace Apps. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 17:01 UTC. SecurityOnline. US Offers $10 Million Reward for IRGC Cyber Commander Yaryab. Cites a CVE in CISA KEV.
  • Mon 7 Sep, 04:31 UTC. SecurityOnline. CISA KEV Missed Four Actively Exploited AI and WordPress Flaws. Cites a CVE in CISA KEV.
  • Mon 7 Sep, 16:08 UTC. The Hacker News. Google Patches Chrome V8 Zero Day Exploited in Active Attacks. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 12:26 UTC. SecurityOnline. Chinese-Linked Spies Exploit Chrome and Windows Zero-Days. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 20:00 UTC. The Hacker News. Chrome Zero-Day Chain BlueMoon Drops Espionage Backdoors on Windows. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 21:06 UTC. Ars Technica, its first report on the story. BlueMoon Exploit Kit Races to Exploit Fresh Chrome and Windows Flaws. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 07:00 UTC. Security Affairs. Chrome and Windows Zero Days Fuel BlueMoon Espionage Campaigns. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 17:25 UTC. SecurityOnline. Chrome Zero Day Chain Targeted NGOs Before Google’s Patch Arrived. Cites a CVE in CISA KEV.
  • Sat 12 Sep, 11:30 UTC. SecurityWeek. Chrome Zero Days Fuel BlueMoon Exploit Kit’s Espionage Surge. Cites a CVE in CISA KEV. This article, 24th of 26.
  • Tue 15 Sep, 11:30 UTC. Security Affairs. China-Linked Groups Exploited Chrome Patch Gap to Target NGOs. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 09:59 UTC. SecurityOnline. Chinese Hackers Exploited Chrome and Windows Zero Days in Espionage Attacks. Cites a CVE in CISA KEV.

BlueMoon is an exploit kit that security researchers say was rapidly adopted by multiple espionage groups in opportunistic, rushed campaigns. The China-linked Violet Typhoon (also known as APT31, JungleBamboo, TA412 and Tide Castle) first deployed BlueMoon on 28 August, with several other Chinese threat actors following soon after.

Proofpoint notes that the kit’s spread appears driven by its ease of adoption and by the fact that it chained together three unpatched flaws: two zero-days in Google Chrome (CVE-2026-85046 and CVE-2026-87491) and a Windows zero-day (CVE-2026-85880). The Chrome flaws affect the V8 JavaScript and WebAssembly engine, and the Windows flaw is an ALPC privilege-escalation issue fixed on September Patch Tuesday.

Proofpoint’s analysis describes a chain that exploits the Chrome vulnerabilities to escape the sandbox, fingerprints the host, and then triggers the Windows privilege escalation. A CreateProcess stub is injected into the Chrome broker process to download and execute a payload via a curl command. The kit was observed in different packaging variants but with the same underlying load chain and orchestration.

Development artefacts suggest AI may have been used in its construction, though no single artefact confirms this. BlueMoon was first seen targeting NGOs and mining entities in the US, and later used against a US aerospace company, a Vietnamese manufacturing organisation, and government, consulting and financial entities in Indonesia and Singapore as the campaign expanded.

Proofpoint emphasises the rapid, cross-actor sharing of BlueMoon and raises concerns that the ease of deployment could lower barriers for other espionage and financially motivated groups. Evidence includes observed deployments by Violet Typhoon, UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket, with vulnerable targets spanning sectors and regions.

How the story developed

All 26 articles
Quiet for 5 weekslast report 24 Sep26 articles6 outlets

26 articles from 6 outlets since 3 Sep. Quiet since 24 Sep. This was the 24th report, 9 days after the first.

Now3 Sep791113151719212325First reportSecurityOnline · 3 Sep, 23:25This article24th of 26 · day 9
  • Thu 3 Sep, 23:25 UTC. SecurityOnline, first report. Google Rushes Out Chrome Patch for Exploited V8 Zero Day. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 04:35 UTC. SecurityOnline. OpenAI Drops Long Context Charges for GPT-6 Astra in Codex. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 08:41 UTC. The Hacker News, its first report on the story. Google Patches Chrome Zero Day Exploited in V8 Attacks. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:16 UTC. SecurityOnline. Sneaky 2FA Phishing Campaign Targets Healthcare with AiTM Attacks. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:16 UTC. SecurityOnline. Microsoft Teams Vishing Campaign Tricks 150 Workers Into Malware Attacks. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:16 UTC. SecurityOnline. AWS Root Accounts Hit in Password Spraying Campaign Across 150 Firms. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 09:51 UTC. Security Affairs, its first report on the story. Google Patches Actively Exploited Chrome V8 Zero Day. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 11:35 UTC. SecurityOnline. FreeSWITCH api-chat Flaw Exploited via SIP Messages on FusionPBX. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 11:36 UTC. SecurityOnline. Trezor Warns 80,000 Customers After ShipMonk Data Breach. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 12:10 UTC. SecurityWeek, its first report on the story. Google Patches Chrome V8 Zero Day Exploited in the Wild. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 19:11 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Google Chrome V8 Flaw as High Risk. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 21:01 UTC. CISA. CISA Warns of Actively Exploited Chromium Flaw Allowing Code Execution. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 21:01 UTC. CISA. CISA Flags Chrome V8 Flaw Affecting Major Chromium Browsers. Cites a CVE in CISA KEV.
  • Fri 4 Sep, 23:57 UTC. Security Affairs. CISA Flags Actively Exploited Chrome Flaw as Sixth 2026 Zero-Day. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 11:46 UTC. SecurityOnline. Google Expands Gemini Live Voice Features Across Workspace Apps. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 17:01 UTC. SecurityOnline. US Offers $10 Million Reward for IRGC Cyber Commander Yaryab. Cites a CVE in CISA KEV.
  • Mon 7 Sep, 04:31 UTC. SecurityOnline. CISA KEV Missed Four Actively Exploited AI and WordPress Flaws. Cites a CVE in CISA KEV.
  • Mon 7 Sep, 16:08 UTC. The Hacker News. Google Patches Chrome V8 Zero Day Exploited in Active Attacks. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 12:26 UTC. SecurityOnline. Chinese-Linked Spies Exploit Chrome and Windows Zero-Days. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 20:00 UTC. The Hacker News. Chrome Zero-Day Chain BlueMoon Drops Espionage Backdoors on Windows. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 21:06 UTC. Ars Technica, its first report on the story. BlueMoon Exploit Kit Races to Exploit Fresh Chrome and Windows Flaws. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 07:00 UTC. Security Affairs. Chrome and Windows Zero Days Fuel BlueMoon Espionage Campaigns. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 17:25 UTC. SecurityOnline. Chrome Zero Day Chain Targeted NGOs Before Google’s Patch Arrived. Cites a CVE in CISA KEV.
  • Sat 12 Sep, 11:30 UTC. SecurityWeek. Chrome Zero Days Fuel BlueMoon Exploit Kit’s Espionage Surge. Cites a CVE in CISA KEV. This article, 24th of 26.
  • Tue 15 Sep, 11:30 UTC. Security Affairs. China-Linked Groups Exploited Chrome Patch Gap to Target NGOs. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 09:59 UTC. SecurityOnline. Chinese Hackers Exploited Chrome and Windows Zero Days in Espionage Attacks. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 26 articles as a list
  1. Thu 3 SepDay 01
    1. Google Rushes Out Chrome Patch for Exploited V8 Zero Day23:25 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
  2. Fri 4 SepDay 113
    1. OpenAI Drops Long Context Charges for GPT-6 Astra in Codex04:35 · SecurityOnline · Known exploited CVE
    2. Google Patches Chrome Zero Day Exploited in V8 Attacks08:41 · The Hacker News · Known exploited CVE
    3. CISA Flags Actively Exploited Google Chrome V8 Flaw as High Risk19:11 · CISA · official · CISA alert · Known exploited CVE
    Show 10 more from 4 Sep
    1. Sneaky 2FA Phishing Campaign Targets Healthcare with AiTM Attacks09:16 · SecurityOnline · Known exploited CVE
    2. Microsoft Teams Vishing Campaign Tricks 150 Workers Into Malware Attacks09:16 · SecurityOnline · Known exploited CVE
    3. AWS Root Accounts Hit in Password Spraying Campaign Across 150 Firms09:16 · SecurityOnline · Known exploited CVE
    4. Google Patches Actively Exploited Chrome V8 Zero Day09:51 · Security Affairs · Known exploited CVE
    5. FreeSWITCH api-chat Flaw Exploited via SIP Messages on FusionPBX11:35 · SecurityOnline · Known exploited CVE
    6. Trezor Warns 80,000 Customers After ShipMonk Data Breach11:36 · SecurityOnline · Known exploited CVE
    7. Google Patches Chrome V8 Zero Day Exploited in the Wild12:10 · SecurityWeek · Known exploited CVE
    8. CISA Warns of Actively Exploited Chromium Flaw Allowing Code Execution21:01 · CISA · official · Known exploited CVE
    9. CISA Flags Chrome V8 Flaw Affecting Major Chromium Browsers21:01 · CISA · official · Known exploited CVE
    10. CISA Flags Actively Exploited Chrome Flaw as Sixth 2026 Zero-Day23:57 · Security Affairs · Known exploited CVE
  3. Sat 5 SepDay 22
    1. Google Expands Gemini Live Voice Features Across Workspace Apps11:46 · SecurityOnline · Known exploited CVE
    2. US Offers $10 Million Reward for IRGC Cyber Commander Yaryab17:01 · SecurityOnline · Known exploited CVE
  4. Mon 7 SepDay 42
    1. CISA KEV Missed Four Actively Exploited AI and WordPress Flaws04:31 · SecurityOnline · Known exploited CVE
    2. Google Patches Chrome V8 Zero Day Exploited in Active Attacks16:08 · The Hacker News · Known exploited CVE

  5. Quiet for 2 days

    Wed 9 SepDay 63
    1. Chinese-Linked Spies Exploit Chrome and Windows Zero-Days12:26 · SecurityOnline · Known exploited CVE
    2. Chrome Zero-Day Chain BlueMoon Drops Espionage Backdoors on Windows20:00 · The Hacker News · Known exploited CVE
    3. BlueMoon Exploit Kit Races to Exploit Fresh Chrome and Windows Flaws21:06 · Ars Technica · Known exploited CVE
  6. Thu 10 SepDay 72
    1. Chrome and Windows Zero Days Fuel BlueMoon Espionage Campaigns07:00 · Security Affairs · Known exploited CVE
    2. Chrome Zero Day Chain Targeted NGOs Before Google’s Patch Arrived17:25 · SecurityOnline · Known exploited CVE

  7. Quiet for 2 days

    Sat 12 SepDay 91
    1. Chrome Zero Days Fuel BlueMoon Exploit Kit’s Espionage Surge11:30 · SecurityWeek · Known exploited CVE · This article, 24th of 26

  8. Quiet for 3 days

    Tue 15 SepDay 121
    1. China-Linked Groups Exploited Chrome Patch Gap to Target NGOs11:30 · Security Affairs · Picked up again · Known exploited CVE

  9. Quiet for 9 days

    Thu 24 SepDay 211
    1. Chinese Hackers Exploited Chrome and Windows Zero Days in Espionage Attacks09:59 · SecurityOnline · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in