A Chinese threat actor, identified by **Volexity** as **UTA0560**, has been linked to a spear-phishing campaign exploiting recently patched security flaws in **Google Chrome** and **Microsoft Windows**. The objective: to deliver a malicious JavaScript backdoor named **GRIMWEDGE**. **Volexity** reported that this activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026.  ### The Exploit Chain: BlueMoon Researchers Ankur Saini, Conor Quigley, Sean Koessel, Steven Adair, and Tom Lancaster from **Volexity** detailed the attack vector. "The emails contained a message encouraging the users to click a link that led to the website of a U.S.-based university," they stated. "These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain." This exploit chain, dubbed BlueMoon, leverages three distinct vulnerabilities: * **CVE-2026-85046**: An initial flaw in **Chrome** used to gain arbitrary read/write capabilities within the V8 sandbox. * **CVE-2026-87491**: A second **Chrome** vulnerability for escaping the browser sandbox. * **CVE-2026-85880**: A flaw in **Windows Advanced Local Procedure Call (ALPC)**, enabling code injection into the **Chrome** browser process for arbitrary code execution. ### GRIMWEDGE Backdoor Capabilities **UTA0560** has been observed deploying **GRIMWEDGE** using this method. The process begins with a spear-phishing email containing a link to a legitimate website vulnerable to reflective XSS. This vulnerability then triggers the zero-day exploit chain, delivering the malware while filtering out systems not running **Chrome** on **Windows**. Upon successful exploitation, the final exploit page embeds three Base64-encoded binary payloads within JavaScript: * **p1**: Shellcode for host reconnaissance and fingerprinting. * **p2**: Shellcode for **Windows** kernel privilege escalation. * **pp**: Shellcode for browser process injection and payload download. In the case of **UTA0560**, the subsequent payload is an executable named "msgbox.exe." This loader extracts a legitimate **Windows** binary and a malicious DLL ("wsc.dll") to initiate a DLL sideloading chain. The DLL then contacts the C2 server to fetch a text file named after the compromised device's hostname. This text file is an **MSI** installer designed to execute an obfuscated JavaScript backdoor within the **MSI** custom actions. Once launched, **GRIMWEDGE** establishes persistence and communicates with its command-and-control (C2) server (**ocr.opusaccel[.]top**) to receive and execute instructions via the `eval()` command. Its capabilities include: * **Info**: System reconnaissance. * **Dir**: Directory listing. * **Mkdir**: Directory creation. * **Del**: File deletion. * **Tasklist**: Process enumeration. * **Taskkill**: Terminating processes by PID. * **Type**: Reading files up to 5 MB. * **Run**: Executing commands in a hidden window. * **Upload (chunk/commit)**: Facilitating file upload to the compromised host. While **GRIMWEDGE** lacks built-in persistence, lateral movement, or exfiltration beyond basic file operations, it provides a crucial initial foothold for **UTA0560** to survey hosts, retrieve data, and deploy additional tools.  ### JungleBamboo's Credential Theft with LONGTALE **Volexity** also observed a second China-nexus threat actor, **JungleBamboo** (also known as **APT31**), utilizing the same exploit chain around the same timeframe. **JungleBamboo** deployed a loader named **SUPERSTOMP**, which then installed **LONGTALE** (also known as **GemStone**), a credential-stealing **Chrome** extension, from a remote server. **LONGTALE** masquerades as a **Google Gemini Chrome** extension (ID: ckiknalbeplpcpofpnabcnhjcegckfei) to evade detection. Its features include: * Keylogging and form capture. * Cookie and session theft. * Screenshot capture based on C2-supplied keywords. * Bulk exfiltration of keystrokes, cookies, storage data, navigation history, and session metadata to the C2 server every 30 seconds. * Remote command and control. Despite lacking a remote code execution command, **LONGTALE**'s extensive information-theft capabilities were deemed sufficient for **JungleBamboo**'s credential theft and surveillance objectives. ### The Patch Gap Advantage The near-simultaneous use of this specific **Chrome**-**Windows** exploit chain by multiple Chinese threat actors suggests that it may have been shared or sold by the exploit developer. This scenario likely arose from reverse-engineering changes in the **Chromium** source code. Critically, the fixes for the two **Chrome** flaws were pushed to the open-source **Chromium** codebase but had not yet been incorporated into a stable release of **Google Chrome**. This created an unusual 'patch gap,' effectively turning N-day bugs in **Chromium** into zero-days against **Chrome**. With **Chrome**'s release cycle for major milestones being four weeks (now accelerated to every two weeks), attackers likely moved swiftly to exploit this window before official patches were widely deployed. **Volexity** warns that "patch-gap vulnerabilities present an even greater risk, as they create an additional time window for threat actors to conduct exploitation campaigns... as large language models become more popular and effective for rapid vulnerability research and exploit development."