Four Spy Groups Adopted the Same BlueMoon Exploit Kit Within a Week

Researchers at Proofpoint have described an exploit kit named BlueMoon that strings together several vulnerabilities in Google Chrome and Microsoft Windows. What stands out is not so much the chain itself as the speed of its spread: the first recorded use dates to August 28, 2026, and within just a few days the tool had found its way into the hands of several espionage clusters at once.

How the chain works

At its core are three vulnerabilities. Two affect Chrome's V8 engine — a type confusion flaw (CVE-2026-85046) and a V8 sandbox escape that was never even assigned an identifier. The third, CVE-2026-85880, is a buffer overflow in the Windows ALPC mechanism that allows privilege escalation. At the time of the attacks, both Chrome flaws were “patch-gap” zero-days: the fixes were already sitting in the open Chromium source code but had not yet reached the browsers' stable builds. It appears that the kit's developer was closely tracking public patches and assembling the exploit faster than the update could reach users.

The attack begins with a phishing email. The victim clicks a link, the two V8 bugs fire one after the other, the code breaks out of the sandbox, and then the Windows vulnerability allows shellcode to be injected and a payload to be loaded — each group bringing its own.

Who used it

The first was China's APT31, which targeted U.S. NGOs and mining and raw-materials companies; it installed a malicious extension disguised as Google Gemini. Next came the clusters UNK_LateNight (U.S. aerospace companies, the ShadowPad backdoor), UNK_DoubleCheck (Vietnamese manufacturing, a Rust binary) and UNK_QuietRacket (the government sector and finance in Indonesia and Singapore). Most of the groups are presumed to be linked to China, but some of the activity could not be attributed.

The fingerprint of artificial intelligence

The abundance of detailed comments and logging in the code led the researchers to suspect that the kit had been built with the help of AI tools. Indirect confirmation came in the form of repeated references to v8CTF, Google's program for finding vulnerabilities in V8. It is unclear whether the exploits were actually written as part of that competition or whether the reference was used to get around the safety guardrails of large language models.

Proofpoint sees this as a troubling shift: a fully weaponized exploit chain for Chrome has always been considered a rare and expensive weapon, yet BlueMoon was developed, deployed and handed out to several actors within a matter of days. AI agents may be lowering the barrier to entry for exploit development — especially for open projects like Chromium, where patches are published before they land in stable builds.

Google closed the Chrome flaw last week, and Microsoft did so on September's Patch Tuesday. CISA added the Chrome vulnerability to its catalog on September 4, giving federal agencies until September 18. The update, however, only closes the entry point: the GemStone extension and the scheduled tasks it creates survive the patch, so anyone who may have been a target should check their system for signs of compromise.

Source: The Hacker News