BlueMoon Exploit Kit Targets Chrome and Windows Endpoints

Security researchers have identified a new BlueMoon exploit kit that chains two Chrome vulnerabilities with a Windows privilege escalation flaw. Proofpoint first observed China-aligned group APT31 using it on August 28, 2026. Three more espionage clusters adopted it within days.

The rapid reuse matters because a fully weaponized Chrome exploit chain has historically been rare and costly to build. Proofpoint noted the kit moved from single-actor to multi-actor use within about a week, despite high detection signals. That speed suggests shared tooling access or a lower barrier to building this capability.

For enterprise defenders, the chain turns one clicked link into full code execution and elevated privileges. It bypasses browser sandboxing and reaches Windows kernel-adjacent territory, raising the stakes beyond a typical browser bug.

Inside the BlueMoon attack chain

A phishing email leads the target to an actor-controlled link. From there, BlueMoon runs through distinct technical steps rather than one mechanism.

• Browser exploitation: The kit triggers CVE-2026-85046, a Chrome V8 type confusion bug, then CVE-2026-87491, a V8 out-of-bounds flaw enabling sandbox escape. Chained together, they give code execution outside the sandbox.
• Host fingerprinting: A reflectively loaded DLL profiles the Windows host. The kit’s JavaScript uses this to decide whether the privilege escalation step is worth attempting.
• Privilege escalation: A second reflectively loaded DLL exploits CVE-2026-85880, a heap-based buffer overflow in Windows ALPC, to elevate the Chrome renderer process.
• Payload execution: The injector shellcode injects a CreateProcess stub into the Chrome broker process. The default command downloads and runs a remote executable via curl.

Both Chrome flaws were patch-gap zero-days. Chromium’s upstream source already had fixes, but they hadn’t reached stable Chrome when attackers exploited them. This suggests the developer tracked public Chromium commits to weaponize the gap before vendors shipped updates.

Four distinct threat clusters, one shared kit

Proofpoint tracked four clusters using BlueMoon within roughly a week, each with its own targeting and payload. China-nexus evidence varies by cluster, so each is stated separately.

• APT31 (from August 28, 2026): Confirmed China-aligned. Targeted U.S. NGOs, mining companies, and commodity trading firms via spear-phishing. The chain delivers a loader that installs a fake “Google Gemini” browser extension, bypassing integrity checks via a technique called GhostChrome-X. The resulting backdoor, GemStone, steals credentials and enables browser surveillance over C2.
• UNK_LateNight (from September 2, 2026): China-aligned per Proofpoint. Targeted U.S. aerospace companies, deploying the ShadowPad backdoor via DLL sideloading.
• UNK_DoubleCheck (from September 2, 2026): No stated nexus. Targeted a Vietnamese manufacturer, hosting BlueMoon on a Cloudflare Workers domain and sideloading a Rust binary that fetches a second sideloading pair from a Cloudflare R2 bucket.
• UNK_QuietRacket (from September 3, 2026): China-aligned per Proofpoint. Targeted government, consulting, and financial firms in Indonesia and Singapore. This variant sideloads a DLL that runs a .NET assembly in memory, which creates a scheduled task for persistence.

Proofpoint said most activity shows a suspected China nexus but cautioned BlueMoon may not be exclusive to China-aligned actors, since some usage remains unattributed. Extensive logging, verbose code comments, and repeated v8CTF references suggest possible AI-assisted development. Proofpoint said it’s unconfirmed whether this reflects genuine bounty research or an attempt to bypass AI model guardrails.

Patch status and federal remediation deadlines

CISA added all three CVEs to its Known Exploited Vulnerabilities catalog. Federal Civilian Executive Branch agencies must remediate CVE-2026-85046 by September 18, CVE-2026-85880 by September 22, and CVE-2026-87491 by September 23, 2026.

Patching closes the entry point. It does not remove anything an attacker already installed through that entry point. Organizations need to check for persistence artifacts separately from confirming the patches are applied.

Post-exploitation indicators to hunt for

Security teams should check managed endpoints for the following artifacts, which can persist after the browser and OS are patched:

• Process tree: chrome.exe spawning cmd.exe, then curl.exe, then msgbox.exe
• File: ChromeUpdate.exe or msgbox.exe in the Windows %TEMP% folder
• Folder: C:\Users\Public\stomp_ext
• Scheduled tasks: EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, Avpcheckup, or GeForceService
• Mutex: Dataupcheckinfo
• Registry key: HKCU\SOFTWARE\Classes\CLSID{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32

Proofpoint has also published detection signatures for the kit’s JavaScript loader and its C2 traffic.

Featured resource

Cybersecurity kit

Download this cybersecurity kit for blueprints, frameworks, checklists, policy templates, and guides securing your enterprise.

DOWNLOAD

Where Hexnode fits

The BlueMoon exposure centers on Chrome and Windows, but Hexnode’s endpoint coverage extends further. UEM manages configuration compliance across Windows, Linux, macOS, Android, and iOS, and automated OS and third-party application patch management (including Chrome) for Windows and macOS, while XDR investigates what happened after exploitation on managed endpoints.

UEM

• Hexnode UEM flags devices still running vulnerable browser or OS builds.
• Pushes emergency patch policies for OS updates and third-party browsers like Chrome across Windows and macOS endpoints.

XDR

• Hexnode XDR investigates suspicious activity on managed endpoints, primarily Windows and macOS.
• Surfaces post-exploitation behavior, such as chrome.exe spawning cmd.exe or curl.exe, by mapping endpoint activity to MITRE ATT&CK tactics.
• Provides one-click remediation capabilities, allowing security operations to isolate compromised endpoints or terminate malicious process trees instantly.
• Complements, rather than replaces, vendor patching and the artifact-level hunting described above.

Conclusion

BlueMoon shows how quickly a rare capability, a fully weaponized Chrome exploit chain, can spread across unrelated threat actors once it exists. Patching the browser and the OS closes the entry point, but four separate clusters already used that entry point to install different persistence mechanisms.

Enterprise security teams should treat this as two separate jobs: confirm patches are deployed everywhere, and hunt for the artifacts left behind before those patches went out.