Researchers have uncovered a powerful new exploit kit dubbed “BlueMoon,” which stitches together zero-day vulnerabilities in the Chrome browser and Microsoft Windows to infiltrate government, defense, and commercial systems globally. Tracked by Proofpoint, BlueMoon has already been adopted by at least four threat groups since late August 2026, many of them believed to have links to China. The first documented operation came from TA412 (also known as Violet Typhoon/APT31) on August 28, followed rapidly by other actors using the same toolkit.
The Exploit Chain Explained
The BlueMoon attack sequence unfolds in three stages. Initially, a type-confusion bug in Chromium’s V8 JavaScript engine (CVE-2026-85046) allows remote code execution inside Chrome’s renderer process by exploiting the V8 just-in-time (JIT) compiler. The second stage breaks out of Chrome’s V8 sandbox via manipulation of WebAssembly metadata, enabling attackers to replace compiled functions with malicious shellcode. Finally, a Windows kernel local privilege escalation vulnerability (CVE-2026-85880) is used to gain full control over the browser process by abusing Advanced Local Procedure Call and the Windows Notification Facility.
Crucially, the two Chrome-side bugs were “patch-gap” zero-days: their fixes were already in Chromium’s source code but had not yet made it into stable release channels. That gap gave attackers several weeks to build exploits before end-users could get protected.
Who’s Using It—and How
TA412 used BlueMoon to target NGOs, mining firms, commodity traders, and others via spear-phishing tactics, often masquerading as academic conference invitations or internships. In one campaign, a Trojan Chrome extension called GemStone—masquerading under the guise of a popular AI tool—was used to capture keystrokes, cookies, screenshots, and issue commands over HTTP.
Other clusters have followed suit: “UNK_LateNight” struck aerospace firms using a ShadowPad backdoor delivered via DLL sideloading; “UNK_DoubleCheck” compromised a Southeast Asian gov-email account before deploying a Rust loader; and “UNK_QuietRacket” targeted government and financial institutions in Singapore and Indonesia, using phishing tied to events and command channels over DNS-over-HTTPS.
Details suggest BlueMoon was thrown together quickly rather than meticulously planned. The Windows privilege escalation works only on older OS versions like Windows 10 and Server 2019/2022. Many delivery infrastructures were spun up the same day as campaigns.
Proofpoint also uncovered signs BlueMoon development leaned on AI tooling: verbose debug comments, diagnostic logging, and handover documents resembling ones used by generative agents. Code references to Google’s bug bounty framework appear, though it’s unclear whether this reflects legitimate research or attempts to evade AI-safety guardrails.
Risk, Impact, and Response
Organizations that run outdated Windows builds alongside unpatched Chromium-based browsers stand at highest risk. Since BlueMoon exploits patch-gap flaws—where fixes exist in source but stable browsers lag—these windows are becoming a repeatable method for attackers. Proofpoint warns that espionage and financially motivated threat actors alike are likely to further develop or reuse similar techniques.
To mitigate BlueMoon threats, security teams should ensure stable Chromium-based browsers are fully patched, apply Windows updates especially on older builds, and monitor for unusual browser extension behavior. Endpoint detection systems should be tuned for indicators such as WebAssembly metadata anomalies, privilege escalation attempts, and suspicious download-execute activity.
What this means is BlueMoon marks a turning point: browser + OS zero-day chains, once rare and resource-intensive, are now showing up across multiple threat actors within days of each other. This suggests either a shared supply chain or AI-assisted code reuse. The growing prevalence of patch-gaps points to a security supply chain weakness—one that’s ripe for exploitation and requires urgency from browser vendors and corporate defenders alike.
