Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called **BlueMoon** that chains together multiple vulnerabilities in **Microsoft Windows** and **Google Chrome**. The first in-the-wild use of **BlueMoon** has been attributed to the China-aligned state-sponsored group tracked as **APT31** (also known as Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle, and Violet Typhoon) on August 28, 2026. "Within days, several other espionage-motivated clusters began using **BlueMoon**, the majority of which have a suspected China nexus," **Proofpoint** said in a report published today. "However, **BlueMoon** may not be exclusive to China-aligned actors, as some usage remains unattributed and there are also potentially more actors using the exploit kit." ### The Exploit Chain: Three Critical Vulnerabilities The exploit chain employs three vulnerabilities: * **CVE-2026-85046**, a type confusion in V8 in **Google Chrome** * **CVE-2026-87491**, an out-of-bounds bug in V8 in **Google Chrome** that can lead to a sandbox escape * **CVE-2026-85880**, a heap-based buffer overflow vulnerability in **Windows Advanced Local Procedure Call (ALPC)** While **CVE-2026-85046** was patched by **Google** last week, **CVE-2026-85880** was addressed by **Microsoft** as part of its September 2026 Patch Tuesday updates. **Proofpoint** told The Hacker News that **Google**, despite currently not issuing CVEs for V8 sandbox escapes, has assigned one for this specific flaw under **CVE-2026-87491**. A patch for the security defect was released by **Google** on September 8, 2026. Interestingly, both V8 vulnerabilities in **Chrome** are said to have been "patch-gap" zero-days at the time they were maliciously exploited. The enterprise security company said the flaws had already been fixed in public upstream **Chromium** source code but were yet to be propagated to the latest stable releases of **Chrome** and Chromium-based browsers available. It's suspected that the developer behind the exploit kit may have been closely keeping track of publicly available **Chromium** patches to put together the browser exploit chain. ### How BlueMoon Attacks Attack chains making use of **BlueMoon** have been found to rely on phishing emails as a starting point to trick targets into visiting an actor-controlled URL that triggers the two V8 flaws in succession to achieve code execution and escape the browser sandbox. It then exploits the **Windows** local privilege escalation bug to inject shellcode that downloads multiple payloads depending on the threat cluster behind it.  "Following the **Chrome** exploits, the kit uses a reflectively loaded DLL to fingerprint the **Windows** host, which the exploit kit JavaScript uses to decide whether to attempt the LPE exploit," **Proofpoint** researchers Mark Kelly, Greg Lesnewich, Konstantin Klinger, Saher Naumaan, Julia Paluch, David Galazin, and Stuart Del Caliz said. "A second reflectively loaded DLL runs the LPE exploit to elevate the renderer process. With those additional privileges, a separate injector shellcode injects a CreateProcess stub into the parent **Chrome** broker process, executing an operator-specified command. The default command downloads a remotely hosted executable via a curl command and executes it."  Multiple variants of the exploit kit have been detected with subtle changes that removed comments or obfuscated its components, while others incorporate campaign-specific landing pages and redirects, browser-side operating system checks, or additional telemetry. Despite these modifications, the underlying exploit chain remains the same. ### Threat Clusters Leveraging BlueMoon A brief description of the observed attack chains is as follows: * **APT31** (Beginning on August 28, 2026), which used spear-phishing lures to target non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the U.S. to trick victims into clicking on a malicious link that serves **BlueMoon**. This then downloads and runs a loader executable responsible for installing a malicious browser add-on disguised as **Google Gemini** using a **Chrome** extension integrity bypass technique called **GhostChrome-X**. The extension is a browser-surveillance and credential-theft backdoor dubbed **GemStone** that allows the threat actor to issue commands through a command-and-control (C2) channel. * **UNK_LateNight** (Beginning on September 2, 2026), a China-aligned threat cluster which used spear-phishing lures to target multiple U.S. aerospace companies and lead victims to malicious links that deploy **BlueMoon** and the **ShadowPad** backdoor using DLL sideloading. * **UNK_DoubleCheck** (Beginning on September 2, 2026), which used spear-phishing lures to target a Vietnamese manufacturing entity to send victims to an actor-controlled Cloudflare Workers domain hosting **BlueMoon**. This is then used to initiate a DLL sideloading attack to drop a Rust binary. The malware, for its part, contacts a Cloudflare R2 Bucket to fetch and execute a second DLL sideloading pair. * **UNK_QuietRacket** (Beginning on September 3, 2026), a China-aligned threat actor that used spear-phishing lures to target government, consulting, and financial sector organizations in Indonesia and Singapore to take victims to landing pages that deploy **BlueMoon**. The exploit kit, in this case, has been modified to download and execute a DLL sideloading pair. The rogue DLL communicates with Cloudflare Workers domains to obtain and run a .NET assembly in memory. The .NET in-memory payload is designed to create a scheduled task to launch the DLL sideloading sequence for persistence. ### AI's Role in Exploit Development? What's more, the presence of extensive logging capabilities and verbose comments within the source code artifacts suggests the malware may have been developed with assistance using artificial intelligence (AI) tools. This is also bolstered by repeated references to the **v8CTF** challenge, an exploit-focused vulnerability reward program (VRP) and capture-the-flag (CTF) competition run by **Google** targeting the V8 engine. **Proofpoint** said it's not known if the V8 exploits were genuinely developed against the **v8CTF** bug bounty framework, or if this framing was used by the exploit developers to bypass large language model (LLM) guardrails. "It is currently unknown how multiple distinct threat actors obtained access to the exploit kit," **Proofpoint** said. "Given its ease of adoption, it is likely to proliferate further and be adopted by espionage-motivated and financially motivated threat actors as patched versions are fully rolled out across all Chromium-based browsers." "A fully weaponized **Chrome** exploit chain has historically been a high-value, rare capability. **BlueMoon** was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals." "This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development. This is particularly relevant for open source codebases, such as **Chromium**, where upstream patches are publicly accessible prior to downstream consumers."