Patch-Gap Zero-Days Fueled BlueMoon Kit

A new exploit kit is revealing the perils of the “patch later” mentality. According to the Proofpoint Threat Research team, espionage-motivated threat actors are using a new malicious toolkit to chain together four separate Chrome browser and Microsoft Windows vulnerabilities to launch targeted spear phishing campaigns. Proofpoint, which researched the attack method with Google’s Threat Intelligence Group, Microsoft’s Threat Intelligence Center, and cybersecurity company Volexity, has dubbed it BlueMoon.

The kit’s emergence highlights a structural weakness in how browser patches flow from open-source repositories to end-user machines. BlueMoon strings together three different flaws in Chrome and Chromium-based browsers: a type confusion vulnerability (CVE-2026-85046) in Chromium’s open-source V8 JavaScript engine; a V8 sandbox escape (CVE-2026-87491) due to a WebAssembly defect; and a Windows kernel Local Privilege Escalation (LPE) zero-day found in older Windows builds (CVE-2026-85880). All three vulnerabilities are rated high severity.

Chaining Flaws for One-Click Admin

Chaining CVE-2026-85046 and CVE-2026-87491 essentially allows attackers to run arbitrary code inside Chrome via a click on a phishing link, explained Seva Ioussoufovitch, senior research analyst at Info-Tech Research Group. Adding CVE-2026-85880 “exponentially worsens the impact” by leveraging a Windows kernel exploit to elevate privileges on older Windows instances (Windows 10 22H2, Windows 11 21H2).

“Basically, BlueMoon enables threat actors to gain full Windows admin privileges in one click, and install whatever malware they want on an endpoint,” Ioussoufovitch said.

— Seva Ioussoufovitch, senior research analyst at Info-Tech Research Group

The Patch-Gap Zero-Day Problem

Both V8 vulnerabilities are “patch-gap” zero-days; they were known and fixed in public upstream source code, but remained unpatched in later stable releases of Chrome and Chromium-based browsers, Proofpoint explained. CVE-2026-85046 was first reported to the Chromium project by a security researcher on August 4. A fix was added to the open source Chromium codebase, which essentially serves as the foundation for Google Chrome and Chromium-based browsers. But because the fix had not yet reached newer versions of Google Chrome, there was an “unusual patch gap,” the researchers said.

During that window, threat actors, whose ability to build exploit kits has been “wildly accelerated” by AI, likely had time to reverse engineer exploits from the open source codebase and take advantage of what used to seem like a reasonable patch gap, Ioussoufovitch explained. “Attackers are acting faster, and that means each day a patch is delayed carries more risk than it used to,” he said. Effectively, at the Chromium source level, it was an N-day vulnerability (it was known and had an available patch), but in Google Chrome, it was effectively a zero-day (previously unknown) flaw, the Proofpoint threat team pointed out, noting, “a fully weaponized Chrome exploit chain has historically been a high-value, rare capability.”

Spear Phishing with Rapport Building

In one example, a China-aligned state-sponsored threat actor used the BlueMoon kit to target a small number of non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the US. They launched spear phishing campaigns using a range of lures: posing as university students interested in internships at the organization; outreach regarding upcoming conferences; and even “target-specific rapport-building exchanges” that duped some users into clicking a phishing link. If they did, they were led to an actor-controlled domain, shown a loading page for several seconds as the threat actor attempted the exploit, then were directed to legitimate websites (like GitHub).

This particular campaign began on August 28, and, Proofpoint explained, “within days, several other espionage-motivated clusters began using BlueMoon, the majority of which have a suspected China nexus.” Proofpoint predicted that BlueMoon will “likely proliferate further and be adopted by both espionage-motivated and financially motivated threat actors.”

BlueMoon Spreads Across Attack Clusters

“BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals,” Proofpoint noted. It offers a low cost and low barrier to entry for attackers who are increasingly using AI agents to enhance their tradecraft.

The fact that BlueMoon was used in four separate attack clusters makes it look “less like a specialized weapon and more like reusable infrastructure,” agreed Nick Tausek, lead security automation architect at Swimlane. He pointed out that increased breadth doesn’t necessarily mean attackers are stretching themselves thin. “A modular exploit kit lets different groups chase different objectives without rebuilding the attack chain from scratch,” he noted. Further, one exploit path can surface across industries with completely different risk profiles. “BlueMoon may cast a wide net, but defenders still need to know where it can hurt [victims] most,” Tausek said.

Patching Is Only the First Step

For this specific attack, the fix is straightforward, Ioussoufovitch noted: Patch Chrome and Windows immediately, apply the detection rules Proofpoint has provided, and be sure to re-scan infrastructure for any artifacts linked to the kit, because anything installed by BlueMoon, such as Chrome extensions, scheduled tasks, or registry keys, won’t be removed by the patches. More broadly, the industry needs to remain on high alert, he said. Vendors are patching faster, and organizations need to increase their patching cadence accordingly.

Since many of these attacks are still exploited through social engineering, awareness training also matters, Ioussoufovitch said. However, he acknowledged: “Realistically though, the pace of AI advancement is making user awareness training a losing battle.”

What the Exploit Chain Means for Defenders

The BlueMoon episode underscores that patching the browser alone is insufficient when a kernel-level privilege escalation accompanies it. Organizations must verify that older Windows builds are retired or fully updated, and that endpoint detection tools are tuned to catch post-exploitation artifacts such as rogue scheduled tasks or registry modifications. The fact that the two V8 flaws were fixed upstream but not yet in stable Chrome builds creates an intelligence gap that defenders must actively monitor by watching Chromium commit logs, not just waiting for vendor notifications.

Finally, the rapid adoption of BlueMoon by multiple espionage clusters within days suggests that the barrier to entry for advanced exploit chains continues to fall. Security teams should treat any click on a suspicious link as a potential full-compromise event and have containment procedures ready, rather than relying solely on preventive patching.