China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks

Researcher has discovered a rapidly spreading exploit kit called BlueMoon, which combines vulnerabilities in the Chrome browser with a Windows kernel privilege-escalation flaw to compromise targets in espionage campaigns.

This activity was first observed on August 28, 2026, and at least four threat clusters have adopted it, most of which are suspected to have ties to China.

The initial user of BlueMoon was TA412, also known as JungleBamboo, Violet Typhoon, APT31, and TIDE CASTLE.

This group has previously been linked to Chinese state-sponsored espionage operations and has targeted U.S. non-governmental organizations, mining firms, and physical commodity trading companies.

Within days of its initial observation, other clusters, including UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket, began deploying the same exploit chain against targets in the aerospace, manufacturing, government, consulting, and financial sectors.

Chrome-to-Windows Exploit Chain

BlueMoon combines three vulnerabilities and execution stages to transition from a phishing link to code execution outside of Chrome’s renderer sandbox:

• CVE-2026-85046, a V8 JavaScript engine type-confusion bug enabling remote code execution in Chromium-based browsers.
• A V8 sandbox escape that allows attacker-controlled shellcode to execute beyond the browser renderer.
• CVE-2026-85880, a Windows kernel local privilege escalation flaw used against older Windows builds.

The Chrome vulnerability is particularly concerning as a “patch-gap” zero-day. Although the relevant fix for the V8 vulnerability was committed to the public Chromium source code on August 7, it wasn’t incorporated into the stable Chromium build until September 3.

This created a nearly four-week window during which attackers could reverse-engineer the public patch and weaponize the flaw against users of stable Chrome and other Chromium-based browsers.

The V8 exploit exploits an optimization weakness involving `Array.prototype.sort()` and `Array.fill()`. By changing the element type of an array during a sort operation, BlueMoon tricks V8’s Maglev and TurboFan optimizing compilers into treating object references as small integers.

This creates an address leak that lets the exploit construct `addrof` and `fakeobj` primitives, ultimately achieving arbitrary read/write access within V8’s heap cage.

Next, BlueMoon corrupts WebAssembly module metadata to overwrite compiled function bodies with shellcode. A reconnaissance DLL loaded reflectively identifies the Windows version, build number, Chrome integrity level, and `kernelbase.dll` version before determining whether the target is suitable for local privilege escalation.

The local privilege escalation (LPE) component of BlueMoon targets specific older Windows versions: Windows 10 version 1809; Windows 10 versions 2004 through 22H2; Windows Server 2019 and 2022; and Windows 11 for version 21H2.

The exploit uses Advanced Local Procedure Call and Windows Notification Facility mechanisms to gain kernel read/write access and enable the `SeDebugPrivilege` in the Chrome renderer process.

With elevated privileges, BlueMoon injects shellcode into the parent Chrome broker process. The default launcher utilizes `curl` to download an executable, save it as `%TEMP%\msgbox.exe`, and execute it outside the browser sandbox. This behavior provides defenders with potentially high-confidence indications for endpoint detection.

TA412 employed BlueMoon to install GemStone, a malicious Chrome extension that masquerades as an AI-powered Google Gemini browsing companion.

This extension collects keystrokes, cookies, browser storage, navigation activity, active tab metadata, and screenshots. It also modifies Chromium Secure Preferences files with valid HMAC values, allowing the extension to install without triggering typical integrity protections.

UNK_LateNight targeted U.S. aerospace organizations with business-to-business and request-for-quotation lures. Its deployment of BlueMoon delivered ShadowPad through a DLL sideloading chain, created a scheduled task for persistence called EdgeCore_AutoUpdate, and communicated with command-and-control infrastructure over HTTPS.

Meanwhile, UNK_DoubleCheck used compromised Southeast Asian government email accounts to target a Vietnamese manufacturer and delivered a Rust-based in-memory loader.

UNK_QuietRacket focused on Singapore and Indonesia, using conference-themed phishing emails, and deployed a DLL sideloading chain that used DNS-over-HTTPS TXT records for command-and-control resolution.

Proofpoint noted that BlueMoon’s extensive debug logging, implementation comments, and references to a markdown handover document may suggest the kit was developed with AI assistance.

While this assessment remains unconfirmed, the exploit’s rapid adoption highlights how publicly visible Chromium patches can greatly reduce the time and expertise needed to operationalize browser exploitation.

Ioc

TA412
Indicator	Type	Description	First Seen
779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d	SHA256	driver-html.js(BlueMoon exploit JavaScript)	August 2026
ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b	SHA256	BlueMoon exploit JavaScript	August 2026
7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288	SHA256	ChromeUpdate.exe (or msgbox.exe)	August 2026
e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004	SHA256	dist.zip	August 2026
353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee	SHA256	background.js	August 2026
secboxes[.]com	Domain	TA412 delivery and download domain	August 2026
msbenefit[.]com	Domain	TA412 delivery and download domain	September 2026
attcdn[.]com	Domain	TA412 delivery and download domain	September 2026
recommendation-letter.secboxes[.]com	Hostname	TA412 BlueMoon exploit page	August 2026
asianstudies.secboxes[.]com	Hostname	TA412 BlueMoon exploit page	August 2026
materials-project.secboxes[.]com	Hostname	TA412 BlueMoon exploit page	August 2026
project.secboxes[.]com	Hostname	TA412 BlueMoon exploit page	August 2026
evidence.msbenefit[.]com	Hostname	TA412 BlueMoon exploit page	September 2026
data.attcdn[.]com	Hostname	TA412 BlueMoon exploit page	September 2026
hxxps://project.secboxes[.]com/ChromeUpdate.exe	URL	Download URL	August 2026
hxxps://recommendation-letter.secboxes[.]com/ChromeUpdate.exe	URL	Download URL	August 2026
hxxps://download.secboxes[.]com:443/dist.zip	URL	Download URL	August 2026
hxxps://api-prod.secboxes[.]com:443/download	URL	Download URL	August 2026
hxxps://evidence.msbenefit[.]com/msgbox.exe	URL	Download URL	September 2026
hxxps://zki0y83.msbenefit[.]com:443/feed	URL	Download URL	August 2026
extension-management-portal.centerfjdr658.workers[.]dev	Hostname	GemStone browser extension C&C	August 2026
extension-management-portal.kmjukilo-lkjh.workers[.]dev	Hostname	GemStone browser extension C&C	September 2026

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.