Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
Summary: A Chinese threat actor tracked as UTA0565 exploited a Chrome and Windows zero-day chain, combining CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to escape the browser sandbox and achieve remote code execution, with attacks detected on September 3 and 4, 2026. The campaigns used fake websites impersonating media organizations, an NGO, and the Center for American Progress, and delivered a Visual C-built malware family called CLEANGULP that uses the hard-coded domain "thecovnresation[.]com" for command-and-control over HTTP.
What's compelling: Volexity said the activity reflects only two organizations' observations and that the full scope and impact are likely far broader, with the shared exploit kit suggesting coordinated weaponization across the Chinese CNE community.