Four Espionage Groups Adopted the Same Chrome and Windows Exploit Kit in Six Days

Between August 28 and September 3, 2026, four separate espionage clusters ran the same exploit kit. Proofpoint published the details today and named it BlueMoon. It chains two Google Chrome V8 vulnerabilities and one Windows privilege escalation bug into a single path that starts with a click on a phishing link and ends with an operator-chosen command running outside the browser sandbox. Two of the three bugs were patch-gap zero-days: already fixed in public upstream Chromium source, not yet shipped to stable Chrome.

The speed is the part that should reset your assumptions. A capability that historically stayed inside one state-aligned group for months moved to four distinct clusters in six days, with the majority assessed as China nexus and at least some usage unattributed.

The chain

BlueMoon uses three vulnerabilities in sequence. The first two are in V8, Chrome's JavaScript engine, and run back to back from an actor-controlled landing page. The third is in Windows.

• CVE-2026-85046, a type confusion in V8 in Google Chrome, patched by Google in the week before the report.
• A V8 sandbox escape with no assigned CVE identifier, used to break out of the V8 sandbox after the type confusion lands.
• CVE-2026-85880, a heap-based buffer overflow in the Windows Advanced Local Procedure Call subsystem, addressed by Microsoft in the September 2026 Patch Tuesday release.

After the browser exploits succeed, the kit reflectively loads a DLL that fingerprints the Windows host. The kit's JavaScript reads that fingerprint and decides whether the local privilege escalation attempt is worth making. If yes, a second reflectively loaded DLL runs the ALPC exploit to elevate the Chrome renderer process. A separate injector shellcode then pushes a CreateProcess stub into the parent Chrome broker process and executes whatever command the operator configured. The default command pulls a remotely hosted executable with curl and runs it.

That default matters for detection. A curl process whose parent is chrome.exe is not normal on a corporate endpoint, and it is the cheapest observable in this entire chain.

Four operators, four payload sets

The exploit chain stayed constant across every cluster. What changed was the landing page, the obfuscation, and everything after the injector.

• APT31, starting August 28, 2026. Also tracked as Bronze Vinewood, Judgement Panda, Violet Typhoon, and TA412. Spear-phished U.S. NGOs, mining companies, and physical commodity trading firms. Delivered a loader that installs a browser add-on disguised as Google Gemini, using a Chrome extension integrity bypass called GhostChrome-X. The extension, GemStone, is a browser surveillance and credential theft backdoor with its own C2 channel.
• UNK_LateNight, starting September 2, 2026. China-aligned. Targeted multiple U.S. aerospace companies and deployed the ShadowPad backdoor via DLL sideloading.
• UNK_DoubleCheck, starting September 2, 2026. Targeted a Vietnamese manufacturing entity from a Cloudflare Workers domain, sideloaded a DLL to drop a Rust binary, which then pulled a second sideloading pair from a Cloudflare R2 bucket.
• UNK_QuietRacket, starting September 3, 2026. China-aligned. Targeted government, consulting, and financial organizations in Indonesia and Singapore. Its modified kit downloads a DLL sideloading pair; the rogue DLL fetches a .NET assembly from Cloudflare Workers domains, runs it in memory, and the assembly creates a scheduled task to re-launch the sideloading sequence for persistence.

Three of the four route command and control through Cloudflare Workers or R2. That is deliberate: the traffic terminates on infrastructure most organizations cannot block wholesale, and the certificate and domain reputation are clean by default.

The AI question

Proofpoint noted extensive logging and verbose comments in the source artifacts, which is atypical for operational offensive tooling and consistent with AI-assisted development. The code also repeatedly references v8CTF, Google's exploit-focused vulnerability reward and capture-the-flag program for the V8 engine. Proofpoint states plainly that it does not know whether the exploits were genuinely built for the v8CTF bounty framework or whether that framing was used to talk a large language model past its guardrails. Either reading is worth your attention: a legitimate bug bounty pipeline feeding an espionage kit, or a working technique for laundering exploit development through a commercial model.

What to do this week

The immediate work is version enforcement, not threat hunting. Both halves of the chain now have patches available.

defaults read "/Applications/Google Chrome.app/Contents/Info.plist" CFBundleShortVersionString
find ~/Library/Application\ Support/Google/Chrome -maxdepth 3 -name Extensions -type d
grep -rl "Gemini" ~/Library/Application\ Support/Google/Chrome/*/Extensions 2>/dev/null

Where this goes

Proofpoint says it does not know how four distinct actors obtained the same kit. Shared vendor, shared quartermaster, and leak are all live options, and the report does not pick one. What the report does say is that BlueMoon is easy to adopt and likely to proliferate to financially motivated actors as the patches roll out across all Chromium-based browsers. That is the pattern: the patch window closes for well-run enterprises, the kit gets recycled downstream, and the long tail of unmanaged and slow-updating browsers absorbs the rest of its useful life. Hunt for the curl-from-chrome.exe lineage now, because that observable survives the exploit chain going stale.

defaults read "/Applications/Google Chrome.app/Contents/Info.plist" CFBundleShortVersionString

powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID, InstalledOn"

find ~/Library/Application\ Support/Google/Chrome -maxdepth 5 -name manifest.json -path "*/Extensions/*" -exec sh -c 'echo "--- $1"; grep -m2 -E "\"name\"|\"version\"" "$1"' _ {} \;

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot -userInitiated YES

powershell -NoProfile -Command "Start-Process -FilePath 'C:\Windows\System32\UsoClient.exe' -ArgumentList 'ScanInstallWait' -Wait"

mkdir -p ~/quarantine && mv ~/Library/Application\ Support/Google/Chrome/Default/Extensions/EXTENSION_ID ~/quarantine/