A rapidly adopted exploit kit, dubbed BlueMoon, chains Chrome and Microsoft Windows zero-days to compromise targets in espionage-focused phishing campaigns.
Most observed activity has been linked to China-aligned clusters, although researchers cautioned that the toolkit cannot yet be attributed exclusively to Chinese state-backed operators.
The campaign was first observed on August 28, 2026, when TA412, also tracked as JungleBamboo, Violet Typhoon, APT31, and TIDE CASTLE, used BlueMoon against US non-governmental organizations, mining companies, and commodity-trading firms.
China-Linked Hackers Exploit Chrome and Windows Zero-Days
Within days, the same underlying exploit chain appeared in operations attributed to suspected China-aligned clusters targeting US aerospace companies, Vietnamese manufacturers, and government, financial, and consulting organizations in Indonesia and Singapore.
BlueMoon exploits CVE-2026-85046, a type-confusion vulnerability in Chrome’s V8 JavaScript engine, alongside a V8 sandbox escape and CVE-2026-85880, a Windows kernel local privilege-escalation flaw.
The browser component abuses an optimization error involving Array.prototype.sort and fill() to obtain memory read-and-write primitives in V8’s heap cage. Attackers then manipulate WebAssembly metadata to execute native shellcode beyond the renderer sandbox.
The exploit kit uses a reflective DLL to fingerprint the compromised host, gathering Windows version, build information, token integrity level, and kernelbase.dll details before deciding whether to trigger the Windows kernel exploit.
The privilege-escalation stage affects older Windows versions, including Windows 10 builds 17763 and 19041–19045, Windows Server 2019 and 2022, and Windows 11 21H2.
After elevation, BlueMoon injects a CreateProcess stub into Chrome’s broker process and executes an operator-defined command. In its default configuration, the exploit downloads an executable to the victim’s temporary directory using curl and launches it.
This noisy behavior creates multiple detection opportunities for endpoint products, suggesting rapid deployment may have taken priority over operational stealth.
TA412 used BlueMoon to install a malicious Chromium extension called GemStone, disguised as an “AI-powered browsing companion by Google Gemini.”
The extension can capture keystrokes, cookies, browser storage, session data, screenshots, and navigation activity. It also supports remote commands for arbitrary HTTP requests, active-tab data collection, keyword monitoring, and browser-side code injection.
Other clusters delivered different payloads. UNK_LateNight used the framework to deploy ShadowPad against US aerospace firms through defense-industry-themed request-for-quotation lures.
UNK_DoubleCheck targeted a Vietnamese manufacturer with a Rust-based loader delivered through DLL sideloading. Meanwhile, UNK_QuietRacket targeted Indonesia and Singapore using conference-themed phishing and malware that resolved command-and-control infrastructure through Google DNS-over-HTTPS.
Proofpoint said BlueMoon’s widespread logging, debugging comments, markdown handover references, and v8CTF artifacts are consistent with possible AI-assisted exploit development, though not conclusive evidence.
The activity demonstrates how publicly available Chromium patches can create a “patch-gap” window, enabling attackers to weaponize upstream fixes before stable browser releases are fully updated.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
