BlueMoon Exploit Kit Leverages Chrome and Windows Zero-Days for Espionage
A new exploit kit dubbed 'BlueMoon' is chaining zero-day vulnerabilities in Google Chrome and Microsoft Windows, enabling espionage groups to deploy backdoors and surveillance tools against high-value targets.
A sophisticated new exploit kit, named "BlueMoon" by researchers at Proofpoint, has emerged and is being rapidly adopted by multiple espionage-motivated threat actors. Since late August 2026, at least four distinct threat clusters, many with suspected ties to China, have been observed deploying this kit. The exploit chain targets government, defense, and commercial entities globally, with the first confirmed use attributed to TA412, also known as Violet Typhoon or APT31, on August 28, 2026.
The BlueMoon exploit kit operates by chaining together three vulnerabilities in sequence. It begins with a type-confusion flaw in the V8 JavaScript engine within Chromium, identified as CVE-2026-85046. This vulnerability allows for remote code execution within the browser's renderer by exploiting an optimization bug in V8's Just-In-Time (JIT) compiler. Following this, a V8 sandbox escape is utilized, which corrupts WebAssembly module metadata to overwrite compiled function bodies with attacker-controlled shellcode.
The final stage of the exploit chain involves a Windows kernel local privilege escalation flaw, tracked as CVE-2026-85880. This exploit leverages Advanced Local Procedure Call (ALPC) and Windows Notification Facility (WNF) mechanisms to gain kernel read/write access, thereby elevating privileges within the compromised browser process. Notably, both of the Chrome-related vulnerabilities were "patch-gap" zero-days, meaning that while fixes were available in Chromium's public source code, they had not yet been rolled out to stable browser releases, providing exploit developers with a roughly four-week window to weaponize them.
Proofpoint researchers observed several indicators suggesting that BlueMoon was deployed hastily rather than as a mature, long-planned operation. The Windows privilege escalation component, for instance, is only effective against older builds such as Windows 10 and Server 2019/2022, significantly narrowing the potential target pool. Furthermore, the infrastructure used to deliver the exploits was frequently registered on the same day each campaign was initiated. An unusually basic payload delivery mechanism, employing a simple curl command to download and execute an attacker-supplied file, also offers limited operational stealth and increases detection opportunities for security tools.
Circumstantial evidence within the exploit kit's code has also led researchers to suspect the involvement of AI-assisted development. This includes extensive diagnostic logging, verbose debugging comments, and a referenced markdown "handover" document that bears resemblance to artifacts left by AI coding agents. While references to Google's v8CTF bug bounty framework are present, it remains unclear whether this indicates genuine bounty research or an attempt to circumvent AI model safety guardrails.
Different threat actors have employed BlueMoon with varied tactics. TA412 used spearphishing lures impersonating university interns and academic conference outreach to target US NGOs, mining firms, and commodity trading companies. The ultimate payload in these attacks was a malicious browser extension disguised as "Google Gemini," which Proofpoint tracks as GemStone. This extension functions as a comprehensive surveillance backdoor, capable of keylogging, stealing cookies, capturing screenshots, and executing arbitrary HTTP requests via command-and-control infrastructure.
Other observed campaigns include UNK_LateNight targeting US aerospace companies with defense-themed procurement lures, delivering the ShadowPad backdoor through a DLL-sideloading chain. UNK_DoubleCheck compromised a Southeast Asian government email account to target a Vietnamese manufacturer with a Rust-based loader. Meanwhile, UNK_QuietRacket targeted government and financial organizations in Indonesia and Singapore using conference-themed phishing and DNS-over-HTTPS-based command channels.
Proofpoint's findings suggest that the development of fully weaponized browser exploit chains, historically a rare and costly capability, may be becoming more accessible. The acceleration of exploit development against open-source codebases like Chromium, potentially aided by AI tooling, could lower the barrier to entry. The rapid adoption of the BlueMoon kit by multiple distinct threat actors within days raises concerns about a shared procurement pipeline or "digital quartermaster" model, reminiscent of past mass exploitation events. Organizations running outdated Windows builds alongside unpatched Chromium-based browsers are at the highest risk, and researchers anticipate a proliferation of BlueMoon or similar patch-gap exploitation techniques among both espionage and financially motivated threat actors.