BlueMoon Kit Ties Browser Bugs to AI

A single exploit kit reached four suspected espionage crews in under a week, and the speed with which it moved is drawing attention from researchers who study how intrusion tools spread between groups. Proofpoint says the kit, which it named BlueMoon, chains two Chromium-based browser flaws and one Microsoft Windows vulnerability, and that its first observed use came on August 28. The finding, published Wednesday, points to a patch-gap window and to a development model that the researchers tie to AI-assisted exploitation.

Four Groups, One Toolkit

The initial campaign came from a Beijing-backed group Proofpoint tracks as TA412, also known as Violet Typhoon and APT31, which used BlueMoon to “repeatedly” target non-governmental organizations, mining companies, and physical commodity trading firms in the US, according to the research team. Ties between TA412 and China's Ministry of State Security have been asserted by US authorities, and American prosecutors previously charged seven alleged members with conspiracy to commit computer intrusions and wire fraud.

Within days, other clusters picked up the same kit. Proofpoint reported that “several other espionage-motivated clusters began using BlueMoon, the majority of which have a suspected China nexus,” while cautioning that other, non-China-nexus attackers may also be using it.

Three additional campaigns followed in quick succession. A group tracked as UNK_LateNight targeted multiple US aerospace companies beginning September 2. The same day, a crew tracked as UNK_DoubleCheck hit a Vietnamese manufacturing firm using messages sent from a compromised Southeast Asian government email address. A day later, UNK_QuietRacket targeted government, consulting, and financial-sector organizations in Indonesia and Singapore.

The Three Flaws in the Chain

The first link in the chain is a V8 type confusion flaw tracked as CVE-2026-85046, which allows remote code execution and affects all Chromium-based browsers, including Google Chrome and Microsoft Edge. Google patched it in Chrome on September 3 and stated at the time that it “is aware that an exploit for CVE-2026-85046 exists in the wild.” Microsoft said it fixed the flaw in Edge Stable version 152.0.4191.62 on September 2.

The second component is a Chrome V8 sandbox escape, which also affected all Chromium-based browsers. It carries no CVE because Google does not issue identifiers for sandbox escapes.

The third is a privilege escalation vulnerability in Windows Advanced Local Procedure Call, tracked as CVE-2026-85880, which Microsoft patched on Tuesday. Redmond also warned that this flaw had been exploited as a zero-day before the security update.

The Patch-Gap Problem

Both V8 vulnerabilities were what Proofpoint calls “patch-gap” zero-days at the time of the observed activity. The fixes were known and committed in upstream Chromium source code — a change containing the fix for CVE-2026-85046 was committed on August 7 — but they stayed unpatched in the latest stable releases of Chrome and other Chromium-based browsers available to the public for weeks.

“It is likely that the exploit kit developer used these publicly available Chromium patches to weaponize the browser exploit chain,” the researchers wrote. A Google spokesperson declined to comment beyond what Proofpoint published. Microsoft's spokesperson reiterated that customers who applied the patch are protected.

From Phishing Email to Browser Spy

Attacks begin with a phishing email that lures a victim into clicking an actor-controlled URL. That click triggers the two V8 bugs, allowing remote code execution and a sandbox escape, after which the Windows flaw is used to download multiple payloads. Depending on which group is operating the kit, those payloads include browser-surveillance malware, credential-stealing backdoors, and other tools.

TA412's first campaign used a range of lures. Some emails purported to come from university students interested in internships at the targeted organizations, while others were more target-specific exchanges meant to build trust before a malicious link was sent.

In those cases, the chain “ultimately downloaded and ran a loader executable on the infected host, which then installed a malicious browser extension disguised as Google Gemini on the victim's Chromium-based browser,” the team wrote. That extension, tracked as GemStone, let the operators issue commands through a command-and-control channel, steal cookies and other sensitive data, take screenshots, and inject a keylogger into a browser tab. It also included a keyword monitor that injects an attacker-specified keyword list into the top frame of each page, scans the HTML body for those terms, and triggers a screenshot when it finds a match.

Lures Tailored to Each Target

The campaigns that followed used their own social engineering themes. UNK_LateNight's phishing emails relied on request-for-quotation lures specific to defense industry organizations, and included links to attacker-controlled domains spoofing a variety of US aerospace companies. Those sites served the BlueMoon exploit kit and ultimately loaded a backdoor called ShadowPad, which has circulated among multiple China-aligned groups since 2019.

UNK_QuietRacket's emails used lures tied to Indonesian conferences, including the Indo Startup Expo and Forum 2026 and the World Conference on Creative Economy (WCCE 2026).

What the Numbers Show

• Fewer than 20 organizations globally were targeted across the highlighted activity, according to Proofpoint.
• BlueMoon's first observed use was on August 28, 2026.
• A change containing the fix for CVE-2026-85046 was committed on August 7, weeks before stable releases caught up.
• Google patched the V8 type confusion in Chrome on September 3.
• Microsoft fixed the flaw in Edge Stable version 152.0.4191.62 on September 2, and patched CVE-2026-85880 on Tuesday.
• ShadowPad has been shared among multiple China-aligned groups since 2019.

Damage Appears Limited, Reach Unknown

Mark Kelly, a threat researcher at Proofpoint, told The Register that the researchers don't know exactly who was targeted, nor how, and that so far the damage appears limited.

“In terms of organizations targeted, we saw fewer than 20 organizations globally targeted across the activity highlighted. However, the true number is almost certainly higher than this.”

— Mark Kelly, threat researcher at Proofpoint

Kelly also described how quickly the kit moved between operators, telling The Register that “BlueMoon was developed and deployed rapidly, and shared across multiple threat actors within days,” and that this “may reflect a reduced cost and barrier to entry for this class of capability, which has historically been rare and high value, as AI agents increasingly enable threat actor exploit development.”

He pointed specifically to open-source codebases such as Chromium, where publicly accessible upstream patches create a window for rapid reverse engineering and exploit development ahead of downstream stable releases.

Proofpoint's report credits Greg Lesnewich, Konstantin Klinger, Saher Naumaan, Julia Paluch, David Galazin, and Stuart Del Caliz alongside Kelly.

What Comes After BlueMoon

The team warned that BlueMoon will likely be used by both cyberspies and financially motivated attackers, and that its underlying dynamic is not confined to this one kit.

“The broader dynamic revealed by this activity - rapid exploit development that leverages the open source patch-gap – is likely to recur beyond BlueMoon as this development model becomes accessible,” the researchers wrote.

That prediction matters for anyone running Chromium-based browsers and Windows endpoints, which is a large share of the corporate world. The chain only works when all three flaws are present, so the practical defense is mundane: apply the browser and Windows updates, and understand that the window between an upstream Chromium commit and a stable release is long enough for someone to build a working exploit. Security teams may want to treat patch-gap zero-days as a distinct category in their threat models rather than a one-off, and phishing remains the entry point in every campaign described here, which puts user reporting and email filtering back at the center of the problem. Proofpoint's finding is currently the only detailed account of BlueMoon's use, and the researchers themselves say the true number of victims is probably higher than the fewer than 20 they observed.