One Exploit Kit, Four Spy Groups, One Week

Four separate espionage operations, most of them suspected of working in China's interest, ran the same browser-to-kernel attack chain within six days of each other. The tooling they shared, an exploit kit researchers call BlueMoon, had never been documented before its first appearance on August 28, 2026. Proofpoint reported the finding in a report published September 9, 2026, describing an unusually fast and unusually broad distribution of a fully weaponized chain that combines two Chrome bugs with a Windows privilege-escalation flaw.

A Kit Built From Public Patches

BlueMoon chains three distinct vulnerabilities. The first is CVE-2026-85046, a type confusion flaw in V8, Chrome's JavaScript engine. The second is a sandbox escape in V8 that has no assigned CVE. The third is CVE-2026-85880, a heap-based buffer overflow in Windows' Advanced Local Procedure Call interface, the mechanism Windows components use to pass messages between processes.

Both Chrome bugs were what Proofpoint describes as "patch-gap" zero-days at the time of exploitation. The fixes already existed in Chromium's public upstream source code, but had not yet reached the stable releases of Chrome and other Chromium-based browsers that ordinary users run. That gap, typically measured in days, is the window BlueMoon's author appears to have worked in.

Proofpoint suspects the developer tracked those public Chromium commits closely and reverse-engineered them into a working browser exploit. Google patched CVE-2026-85046 the week before the report, and Microsoft fixed CVE-2026-85880 in its September 2026 Patch Tuesday release.

Phishing First, Shellcode Later

Every observed BlueMoon chain starts the same way: a phishing email that pushes the target toward an attacker-controlled URL. Visiting that page triggers the two V8 flaws in sequence, first achieving code execution inside the browser and then breaking out of the sandbox that is supposed to contain it. With the browser compromised, the kit turns to the Windows ALPC bug to escalate privileges.

The mechanics after that point are described in detail by the Proofpoint research team. A reflectively loaded DLL fingerprints the Windows host, and the kit's JavaScript uses that fingerprint to decide whether it is worth attempting the local privilege-escalation step at all. A second reflectively loaded DLL then runs the LPE exploit to elevate the renderer process. From those elevated privileges, a separate injector drops a CreateProcess stub into the parent Chrome broker process and executes an operator-specified command, which by default uses curl to pull down a remotely hosted executable and run it.

Proofpoint has published detection rules for the kit's JavaScript loader and its command-and-control traffic, numbered 2071919 through 2071924. The company also cataloged the artifacts left behind, which are covered further below.

Four Clusters, Six Days

The first BlueMoon deployment came from APT31, the long-running China-aligned group also tracked as Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle, and Violet Typhoon. Its campaign began on August 28, 2026 and used spear-phishing lures against non-governmental organizations, mining companies, and physical commodity trading firms in the United States.

APT31's chain delivered a loader executable that installed a malicious browser add-on disguised as Google Gemini, using an extension integrity bypass technique called GhostChrome-X. The add-on itself, a surveillance and credential-theft backdoor dubbed GemStone, gives the operator a command-and-control channel for issuing instructions to the infected browser.

Three more clusters followed within days. A group Proofpoint labels UNK_LateNight began on September 2, 2026, targeting multiple U.S. aerospace companies and using BlueMoon to deploy the ShadowPad backdoor through DLL sideloading. Also starting September 2, UNK_DoubleCheck targeted a Vietnamese manufacturing entity, hosting the kit on a Cloudflare Workers domain and using it to launch a DLL sideloading attack that dropped a Rust binary; that binary reached out to a Cloudflare R2 bucket to fetch and execute a second DLL sideloading pair. Then, beginning September 3, 2026, the China-aligned cluster UNK_QuietRacket hit government, consulting, and financial organizations in Indonesia and Singapore with landing pages serving a modified BlueMoon. Its rogue DLL talked to Cloudflare Workers domains to pull a .NET assembly into memory, and that in-memory payload created a scheduled task to relaunch the sideloading sequence for persistence.

Within days, several other espionage-motivated clusters began using BlueMoon, the majority of which have a suspected China nexus. However, BlueMoon may not be exclusive to China-aligned actors, as some usage remains unattributed and there are also potentially more actors using the exploit kit.

— Proofpoint, in its report on the BlueMoon exploit kit

Variants of the kit differ in small ways. Some strip out comments or further obfuscate components; others add campaign-specific landing pages, redirects, browser-side operating-system checks, or extra telemetry. The underlying exploit chain, however, stays the same across all of them.

Signs of AI Assistance

Proofpoint found extensive logging and verbose comments inside the source code artifacts, which the researchers say suggests the malware may have been developed with help from artificial intelligence tools. Supporting that theory, the code repeatedly references the v8CTF challenge, an exploit-focused vulnerability reward program and capture-the-flag competition Google runs for the V8 engine.

Whether the V8 exploits were genuinely built against that bug bounty framework, or whether the framing was inserted to slip past large language model guardrails, is not something Proofpoint could determine. The company also said it remains unknown how multiple distinct threat actors obtained access to the same kit.

It is currently unknown how multiple distinct threat actors obtained access to the exploit kit. Given its ease of adoption, it is likely to proliferate further and be adopted by espionage-motivated and financially motivated threat actors as patched versions are fully rolled out across all Chromium-based browsers.

— Proofpoint, on the likely spread of BlueMoon

A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals.

— Proofpoint, on the significance of the kit's rapid spread

This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development. This is particularly relevant for open source codebases, such as Chromium, where upstream patches are publicly accessible prior to downstream consumers of the codebase applying the patch. This creates a window for threat actors to attempt to rapidly reverse engineer patches and develop exploits ahead of downstream stable releases.

— Proofpoint, on the patch-gap problem in open source codebases

The Federal Deadline

CISA added the Chrome flaw to its Known Exploited Vulnerabilities catalog on September 4, giving U.S. federal civilian agencies until September 18 to patch. That catalog listing carries weight beyond the federal government, since many private organizations use it as a prioritization signal when deciding which fixes to rush through change-control processes.

For anyone caught in one of these campaigns, though, applying the browser update is only half the job. Patching closes the entry path. It does not remove the GemStone extension, and it does not remove the scheduled tasks the other clusters created. Those survive an update.

Proofpoint listed the specific artifacts to hunt for on a potentially compromised host:

• Process tree: chrome.exe starting cmd.exe, then curl.exe, then msgbox.exe
• File: ChromeUpdate.exe or msgbox.exe in the Windows %TEMP% folder
• Folder: C:\Users\Public\stomp_ext
• Scheduled task: EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, Avpcheckup or GeForceService
• Mutex: Dataupcheckinfo
• Registry key: HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32

The scheduled task names are worth noting: EdgeCore_AutoUpdate and MicrosoftEdgeUpdatesTaskMachine imitate browser update jobs, while Avpcheckup and GeForceService mimic security and graphics driver services. None of them belong to the software they appear to name.

Why the Patch Gap Keeps Winning

Chromium's development model is what makes this class of attack possible. The browser engine is open source, so fixes land publicly in the upstream repository before they reach Chrome and the many other browsers built on the same code. The lag between those two moments is small, but it is not zero, and it applies to every downstream consumer of the codebase at once.

An attacker who watches the commit log can see exactly which bug is being fixed and, from the diff, work backward toward a working exploit. The two V8 flaws in BlueMoon's chain were both at that stage when the kit was used against real targets — fixed upstream, still live in the stable builds people were actually running. Proofpoint's assessment is that the kit's developer likely did precisely this kind of patch-watching.

What makes BlueMoon different from a typical advanced persistent threat tool is not the technical difficulty of any single step. It is the packaging. A working Chrome exploit chain plus a Windows privilege-escalation primitive, assembled into something that could be handed to one group after another with only cosmetic changes, each running its own payload and its own infrastructure. The same JavaScript, the same DLLs, different malware on the end.

What This Means Going Forward

If Proofpoint's read is right, the cost of fielding a browser exploit chain may be falling, and the practical consequence for defenders is that the old assumption — that a full Chrome chain is rare, expensive, and reserved for a handful of top-tier actors — may no longer hold. That matters most for organizations that run Chromium-based browsers at scale and cannot patch them the same day a fix lands, whether because of compatibility testing, managed-device policies, or simply the time it takes to push an update through a large fleet.

Two changes in defender behavior follow from the report. The first is speed: the window between an upstream Chromium fix and a stable-channel release is the exact period BlueMoon exploited, so reducing internal lag in that window has direct value. The second is scope: because BlueMoon's payloads persist past patching, an incident response that stops at "browser updated" may leave a surveillance extension and scheduled tasks running. Anyone who finds the indicators above should treat the host as compromised rather than merely out of date.

The broader question raised by Proofpoint's findings is how much of this kit's development was machine-assisted, and whether that lowers the barrier enough to put weaponized browser chains in the hands of groups that could not previously build them. Proofpoint's answer is that it may — and that exploitation against publicly patched upstream code is a risk that grows as that assistance improves. The company also notes the kit is likely to spread further, both among espionage-focused actors and financially motivated ones, once patched versions of Chromium-based browsers are fully rolled out.

For now, the mitigations are the ones that always apply: patch promptly, hunt for the persistence artifacts rather than assuming an update is enough, and treat unusual outbound traffic from browser processes as worth investigating. Proofpoint's detection rules for the kit's loader and command-and-control traffic are published under rule numbers 2071919 through 2071924.