Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
Summary: Proofpoint reported that a previously undocumented exploit kit called BlueMoon, chaining three vulnerabilities in Windows and Chrome, was first used in the wild by China-aligned APT31 on August 28, 2026, and within days by several other espionage-motivated clusters, most with a suspected China nexus. The chain starts with phishing emails leading to an actor-controlled URL that triggers two Chrome V8 flaws to escape the browser sandbox, then a Windows local privilege escalation bug to inject shellcode that downloads payloads, and CISA added CVE-2026-85046, CVE-2026-85880, and CVE-2026-87491 to its KEV catalog with FCEB patch deadlines of September 18, 22, and 23, 2026.
Bottom line: Both Chrome V8 flaws were patch-gap zero-days: fixed in public upstream Chromium source but not yet in stable releases, giving attackers a window to reverse engineer patches before downstream users received them. Patching the browser closes the way in but does not remove what is already installed, and the GemStone extension and scheduled tasks created by other groups survive the patch.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-85046CVE-2026-85880CVE-2026-87491
- Related