BlueMoon Exploit Kit Chains Chrome and Windows Flaws in New Espionage Campaigns
Multiple espionage-focused threat activity clusters have been observed using a previously undocumented exploit kit called BlueMoon, which chains vulnerabilities in Google Chrome and Microsoft Windows to compromise targeted systems.
According to Proofpoint, the first confirmed in-the-wild use of BlueMoon was attributed to the China-aligned threat group APT31 on August 28, 2026. Within days, several other espionage-focused clusters began deploying the same exploit kit, most of which have suspected links to China.
Proofpoint said BlueMoon may not be exclusive to China-aligned threat actors because some activity remains unattributed and additional groups may already have access to the exploit kit.
BlueMoon Exploits Chrome and Windows Vulnerabilities
The BlueMoon exploit chain combines three vulnerabilities:
- CVE-2026-85046 — A type-confusion vulnerability in Google's Chrome V8 JavaScript engine.
- Unassigned V8 sandbox escape — A second Chrome vulnerability that allows the attacker to escape the browser's security sandbox.
- CVE-2026-85880 — A heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC).
CVE-2026-85046 was patched by Google shortly before the campaign was identified, while Microsoft addressed CVE-2026-85880 as part of its September 2026 Patch Tuesday security updates.
Interestingly, Proofpoint said the two Chrome V8 vulnerabilities were being exploited as patch-gap zero-days. The vulnerabilities had already been fixed in publicly available Chromium source code, but the corresponding fixes had not yet reached the latest stable Chrome and Chromium-based browser releases.
This created a window in which attackers could study publicly available Chromium patches and potentially develop working exploits before downstream browser vendors incorporated the fixes.
Phishing Emails Start the Attack
The attacks observed by Proofpoint generally begin with spear-phishing emails designed to convince targeted users to visit an attacker-controlled URL.
Once the victim opens the malicious link, BlueMoon executes the Chrome exploit chain.
The first vulnerability provides code execution inside the browser, while the second V8 vulnerability is used to escape Chrome's sandbox. The attackers then exploit the Windows ALPC vulnerability to achieve local privilege escalation.
After obtaining elevated privileges, BlueMoon can inject shellcode and execute commands on the compromised Windows system.
Proofpoint researchers said the exploit kit uses a reflectively loaded DLL to fingerprint the target machine and determine whether the Windows privilege-escalation stage should be attempted.
A second DLL then executes the Windows LPE exploit, while injector shellcode places a CreateProcess stub inside Chrome's broker process.
The default command downloads an additional executable using curl and launches it on the victim's machine.
APT31 Was the First Confirmed User
APT31 was the first threat actor Proofpoint linked to BlueMoon, beginning on August 28, 2026.
The group used spear-phishing messages against organizations in the United States, including non-governmental organizations, mining companies, and physical commodity trading firms.
After BlueMoon compromised the browser and Windows host, the attackers deployed a loader that installed a malicious browser extension disguised as Google Gemini.
The extension, known as GemStone, functions as a browser surveillance and credential-theft backdoor and provides attackers with a command-and-control channel.
The deployment relied on a Chrome extension integrity bypass technique referred to as GhostChrome-X.
Other Threat Groups Quickly Adopt BlueMoon
Proofpoint identified several additional clusters using the exploit kit shortly after APT31's activity.
UNK_LateNight
Beginning September 2, 2026, UNK_LateNight used spear-phishing attacks against several U.S. aerospace organizations.
Victims were directed to malicious links hosting BlueMoon, which was subsequently used to deploy the ShadowPad backdoor through DLL sideloading.
UNK_DoubleCheck
Also beginning September 2, UNK_DoubleCheck targeted a Vietnamese manufacturing organization.
The attackers directed victims to an actor-controlled Cloudflare Workers domain hosting BlueMoon. The exploit chain was followed by a DLL sideloading attack that deployed a Rust-based binary.
That malware then contacted a Cloudflare R2 bucket to retrieve and execute another DLL sideloading pair.
UNK_QuietRacket
Beginning September 3, UNK_QuietRacket targeted organizations in the government, consulting, and financial sectors in Indonesia and Singapore.
The group used phishing messages to direct victims to landing pages hosting a modified version of BlueMoon.
The exploit kit downloaded a DLL sideloading pair that communicated with Cloudflare Workers domains and retrieved a .NET assembly directly into memory.
The in-memory payload then created a scheduled task to launch the DLL sideloading chain, providing persistence on the compromised system.
BlueMoon Shows Signs of Rapid Development
Proofpoint observed several versions of BlueMoon with relatively small modifications.
Some variants removed comments or introduced additional obfuscation, while others included campaign-specific landing pages, redirects, operating-system checks, and telemetry.
Despite these changes, the underlying Chrome-to-Windows exploit chain remained largely consistent.
Researchers also found extensive logging and unusually detailed comments within parts of the exploit code.
This led Proofpoint to suggest that the toolkit may have been developed with assistance from AI tools, although the company did not present this as a confirmed attribution.
The code also contains references to Google's v8CTF, an exploit-focused vulnerability research and competition program targeting the V8 engine.
Proofpoint said it remains unclear whether the V8 exploits were genuinely developed through research associated with the v8CTF ecosystem or whether references to the program were deliberately included to bypass security restrictions imposed by large language models.
Why BlueMoon Is Significant
Fully weaponized Chrome exploit chains have historically been expensive and difficult capabilities that are rarely available to multiple threat actors.
BlueMoon stands out because it was reportedly developed, deployed, and shared among several threat clusters within a very short period.
Proofpoint believes the availability of public Chromium patches may have reduced the time and expertise required to develop browser exploits.
When upstream Chromium fixes become public before downstream browsers receive those fixes, attackers can potentially reverse-engineer the changes and develop exploits during the gap.
The researchers warned that BlueMoon could therefore spread beyond espionage-focused actors and potentially be adopted by financially motivated cybercriminal groups.
CISA Adds Chrome Vulnerability to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4.
U.S. federal civilian agencies have been given until September 18, 2026, to apply the required security updates.
However, updating Chrome only closes the exploitation path. It does not remove malware or persistence mechanisms that may already have been installed.
Organizations that may have been targeted should therefore investigate their systems for signs of compromise in addition to applying browser and Windows security updates.
BlueMoon Indicators of Compromise
Proofpoint identified several artifacts associated with BlueMoon-related activity, including:
- Process chain:
chrome.exe→cmd.exe→curl.exe→msgbox.exe - Files:
ChromeUpdate.exeormsgbox.exein the Windows%TEMP%directory - Folder:
C:\Users\Public\stomp_ext - Scheduled tasks:
EdgeCore_AutoUpdate,MicrosoftEdgeUpdatesTaskMachine,Avpcheckup, andGeForceService - Mutex:
Dataupcheckinfo - Registry key:
HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32
Proofpoint has also published detection rules for BlueMoon's JavaScript loader and command-and-control traffic under rule identifiers 2071919 through 2071924.
How Organizations Can Protect Against BlueMoon
Organizations should immediately deploy the latest security updates for Google Chrome, Chromium-based browsers, and Microsoft Windows, particularly on systems exposed to spear-phishing campaigns.
Security teams should also investigate suspicious Chrome child processes, unexpected files in temporary directories, newly created scheduled tasks, unusual browser extensions, and unauthorized registry modifications.
Because patching a vulnerable browser does not remove an already-installed payload, organizations that may have been targeted should conduct endpoint investigations and review authentication, process, network, and persistence activity for evidence of compromise.
The rapid adoption of BlueMoon demonstrates how the public availability of upstream browser patches can create a valuable exploitation window for threat actors, particularly when combined with increasingly automated exploit development and AI-assisted malware research.
