Cyber attackers have been using near-perfect replicas of legitimate websites as entry points to deploy a chain of zero-day vulnerabilities targeting Chrome and Windows, ultimately compromising victims’ systems without their knowledge. The deceptive campaign, which exploited flaws before patches were applied in early September 2026, was aimed at Asian government bodies and advocacy groups.
How the Attack Unfolded
In early September—specifically the 3rd and 4th—attackers sent targeted phishing emails that led victims to domains crafted to look like trusted websites. One malicious site duplicated pages from China Digital Times; another mimicked large parts of the Center for American Progress. These sites hid malicious components: a concealed iframe that loaded additional content was used to run attack code in the background, leaving visible content unaltered.
The exploit chain leveraged two unpatched Chrome bugs (CVE-2026-85046 and CVE-2026-87491) to escape browser protections, followed by a Windows elevation-of-privilege vulnerability (CVE-2026-85880) to gain deeper system control. These vulnerabilities in combination allowed attackers to move from the browser’s renderer process into parts of Windows typically shielded from external influence.
CLEANGULP & UTA0565 Behind the Campaign
The group behind the operation, identified as UTA0565, used a modified toolkit previously associated with other threat actors. Although the core framework was familiar, the attackers introduced new payloads and made stealthy tweaks—variable renaming, stripped debugging strings, revised logging—to evade detection and hamper forensic analysis.
The final payload, called CLEANGULP, masquerades beneath a Microsoft-style name and installs itself persistently via a scheduled task. Once in place, it can execute arbitrary commands, list running processes, transfer files to or from the system, and launch additional code on demand. Communication with its command-and-control servers is carried out over standard HTTP, blending in with normal network traffic, while the domains used are often typosquatted versions of trusted organizations—further lowering suspicion.
Detection, Mitigation, and What to Do Now
Security teams are urged to monitor proxy and DNS logs for signs tied to this campaign. Some specific Indicators of Compromise (IoCs) include spoofed domains such as chinadigitaltimes[.]top and americanprgoress[.]top, payloads like chrome_cleanup.exe, and malware hashes tied to the CLEANGULP executable. The payload installs under %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe and establishes persistence via a scheduled task named “MicrosoftIME.”
Patch it: CVE-2026-85880 was addressed in Microsoft’s latest updates, and fixes for the Chrome flaws have also been released. Organizations should review whether any systems are left unpatched—especially unmanaged workstations that could serve as the backbone for a broader intrusion. Filtering inbound email for lookalike or newly registered domains, verifying unexpected policy or advocacy-themed messages through secondary channels, and terminating visible infrastructure tied to known malicious domains are all urgent priorities.
The rising sophistication seen in this campaign reaffirms that phishing is no longer just about tricking people with bad text or grammar: attackers now deploy polished site clones and combine them with unpatched vulnerabilities and custom malware to gain stealthy, long-term access. This trend matters because even users who seem vigilant can be caught off guard when visual cues are perfect and code execution happens silently. Security operations should prepare not just for damage control but for rapid detection and response.
