BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days

1. Executive summary

Proofpoint has documented a previously undocumented exploit kit, "BlueMoon," that chains two Google Chrome V8 zero-days (CVE-2026-85046, CVE-2026-87491) with a Windows Advanced Local Procedure Call (ALPC) privilege-escalation zero-day (CVE-2026-85880) to achieve code execution and post-exploitation payload delivery on Windows endpoints. All three vulnerabilities are in the CISA Known Exploited Vulnerabilities (KEV) catalog. First observed in use on 28 August 2026 by the China-linked actor Violet Typhoon (APT31/TA412), the kit was adopted within days by at least three additional espionage-motivated clusters — most with a suspected China nexus — against NGOs, mining and commodity-trading firms, aerospace, manufacturing, and government, consulting, and financial entities in Indonesia and Singapore. Attribution of the "BlueMoon" name carries no MITRE ATT&CK profile in our verified reference data and must be treated as unconfirmed; the underlying actor attributions (Violet Typhoon/APT31) rest on Proofpoint's reporting. The direct risk to EMEA financial services is opportunistic drive-by compromise of unpatched Chrome/Edge endpoints via phishing-delivered links; the Southeast Asia targeting of financial entities indicates the sector is already in scope.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain (per Proofpoint, as reported by SecurityWeek and The Register)

1. Initial access — phishing. Victims receive a phishing email and click a malicious link, which directs them to an attacker-controlled web page hosting the BlueMoon exploit kit.
2. V8 exploitation — remote code execution. The page exploits two vulnerabilities in Chrome's V8 JavaScript and WebAssembly engine: - CVE-2026-85046 — V8 type confusion allowing remote code execution. Affects all Chromium-based browsers, including Google Chrome and Microsoft Edge. The upstream Chromium fix was committed on 7 August 2026; Google patched it in Chrome Stable on 3 September 2026 (fixed in Chrome 152.0.7977.82/.83 for Windows/macOS, 152.0.7977.82 for Linux), warning that an exploit existed in the wild. Microsoft fixed it in Edge Stable 152.0.4191.62 on 2 September 2026. It was the fifth Chrome zero-day patched in 2026. - CVE-2026-87491 — second V8 flaw, patched as a zero-day on 8 September 2026. - Both were "patch-gap" zero-days at time of use: fixed upstream in Chromium source but unpatched in public stable releases for weeks.
3. Sandbox escape. A Chrome V8 sandbox escape (no CVE assigned — Google does not issue CVEs for sandbox escapes) breaks out of the browser's sandbox. This also affected all Chromium-based browsers.
4. Host fingerprinting. The kit fingerprints the host.
5. Privilege escalation. Exploits CVE-2026-85880, a privilege-escalation vulnerability in Windows Advanced Local Procedure Call (ALPC). Microsoft patched it in the September 2026 Patch Tuesday release and confirmed it was exploited as a zero-day prior to the update.
6. Payload delivery. A CreateProcess stub is injected into the parent Chrome broker process, which downloads an executable via a curl command and executes it.

Key technical specifics

• Affected software: All Chromium-based browsers (Google Chrome, Microsoft Edge, and other forks) on Windows; Windows operating systems vulnerable to CVE-2026-85880.
• Packaging: Proofpoint identified several packaging variations of BlueMoon, all using the same underlying exploit chain and identical orchestration and loading mechanisms.
• CISA KEV: All three vulnerabilities have been added to the KEV catalog.
• AI-development indicators: Retrieved development artifacts suggest the kit's creators may have used AI to build it, though no single artifact conclusively confirms this. Proofpoint assesses that AI agents increasingly enable threat-actor exploit development, particularly for open-source codebases like Chromium where upstream patches create a patch-gap window for rapid reverse engineering.

Attribution and targeting — confidence caveats

• Attribution of the first use to Violet Typhoon (APT31/TA412/Judgement Panda/JungleBamboo/Tide Castle/Bronze Vinewood), and of subsequent use to UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket, is single-sourced to Proofpoint and should be verified before being used for enforcement or attribution-driven blocking decisions. The Register notes US authorities have previously linked TA412 to China's Ministry of State Security and charged seven alleged members.
• The "BlueMoon" actor name has no MITRE ATT&CK profile in our verified reference data — treat the attribution as unconfirmed.
• Proofpoint states it is currently unknown how multiple distinct threat actors obtained access to the kit, and that activity may not be exclusive to China-aligned groups.
• Scale: fewer than 20 organisations observed targeted globally, but Proofpoint assesses the true number is "almost certainly higher."

4. Mitigation & containment

P1 — within 24 hours

• Patch Chrome to ≥ 152.0.7977.82/.83 (Windows/macOS) / 152.0.7977.82 (Linux) — covers CVE-2026-85046. Verify the 8 September update covering CVE-2026-87491 is also applied; force browser relaunch via enterprise policy where users defer updates.
• Patch Microsoft Edge to ≥ 152.0.4191.62 — covers CVE-2026-85046 in Edge.
• Apply the September 2026 Windows Patch Tuesday updates — covers CVE-2026-85880 (ALPC privilege escalation). Microsoft confirms patched customers are protected.
• Hunt for the delivery mechanism: search EDR telemetry for curl.exe spawned by Chrome broker processes (or any browser process spawning curl), and for unexpected child processes of chrome.exe — the CreateProcess stub injection into the Chrome broker is the distinctive post-exploitation signal.
• Block/monitor: alert on browser processes initiating downloads followed by process execution of the downloaded executable.

P2 — within 72 hours

• Extend patch verification to all Chromium-based browsers in the estate — the V8 flaws and sandbox escape affect every Chromium fork, not only Chrome and Edge. Inventory any Chromium forks (e.g., vendor-embedded browsers, third-party applications shipping Chromium) and confirm their patch status with vendors.
• Review email security posture against the phishing-link initial access vector; confirm URL rewriting and time-of-click sandboxing is enabled.
• Hunt retrospectively for activity since 28 August 2026 (first observed BlueMoon use) on endpoints running unpatched Chrome/Edge: browser crashes followed by curl.exe execution, ALPC-related anomalies, and unexplained executable downloads.

P3 — within 7 days

• Update vulnerability-management policy for KEV-listed flaws: treat CISA KEV addition as a trigger for expedited (non-standard-cadence) patching, given the demonstrated patch-gap weaponisation window.
• Review browser patch SLAs: the upstream Chromium fix for CVE-2026-85046 existed from 7 August but stable releases were unpatched for weeks — assess whether your browser update ring structure leaves a comparable gap and compress it for actively exploited flaws.
• Brief SOC and fraud/compliance teams on the espionage (not financially motivated) nature of the observed activity to date, while noting Proofpoint's assessment that financially motivated adoption is likely.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

6. Detection

rule EXPLOIT_KIT_BlueMoon_Chrome_Broker_Stub
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-12"
        reference = "https://www.securityweek.com/bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days/"
        description = "Detects BlueMoon exploit kit delivery stub based on CreateProcess injection into Chrome broker and curl-based payload download behaviour."
    strings:
        $create_process = "CreateProcess" ascii
        $curl_download = "curl" ascii
    condition:
        all of them
}

title: BlueMoon exploit kit - Chrome broker process spawning curl to download and execute payload
id: AT-2026-09-12-859-01
status: experimental
description: Detects the BlueMoon exploit kit post-exploitation behaviour where a CreateProcess stub injected into the parent Chrome broker process downloads an executable via curl and executes it.
references:

    - https://www.securityweek.com/bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days/
    - https://www.theregister.com/research/2026/09/09/novel-blue-moon-kit-targeting-chrome-and-windows-reflects-new-reality-of-ai-driven-exploits/5295399
author: Adverse Trace
date: 2026/09/12
logsource:
    category: process_creation
    product: windows
detection:
    selection_browser_parent:
        ParentImage|endswith: '\chrome.exe'
    selection_curl:
        Image|endswith: '\curl.exe'
    condition: selection_browser_parent and selection_curl
falsepositives:

    - Legitimate browser extensions or applications that invoke curl from Chrome processes (rare)
level: high

7. Sources

• SecurityWeek — BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days — https://www.securityweek.com/bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days/ — 2026-09-12
• The Register — Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits — https://www.theregister.com/research/2026/09/09/novel-blue-moon-kit-targeting-chrome-and-windows-reflects-new-reality-of-ai-driven-exploits/5295399 — 2026-09-09
• Malwarebytes Labs — BlueMoon exploit kit turns Chrome and Windows flaws into attacks — https://www.malwarebytes.com/blog/bugs/2026/09/bluemoon-exploit-kit-turns-chrome-and-windows-flaws-into-attacks — 2026-09
• The Hacker News — Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week — https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html — 2026-09
• BleepingComputer — Google patches new Chrome zero-day flaw exploited in the wild — https://www.bleepingcomputer.com/news/security/google-patches-fifth-chrome-zero-day-bug-exploited-in-attacks-this-year/ — 2026-09
• Help Net Security — Google patches actively exploited Chrome zero-day (CVE-2026-85046) — https://www.helpnetsecurity.com/2026/09/04/google-chrome-zero-day-cve-2026-85046/ — 2026-09-04
• SecurityWeek — Google Patches 5th Chrome Zero-Day Exploited in 2026 — https://www.securityweek.com/google-patches-5th-chrome-zero-day-exploited-in-2026/ — 2026-09

8. Adverse Trace position

BlueMoon is significant less for its individual components — three now-patched, KEV-listed vulnerabilities — than for what it demonstrates about attacker speed: a full RCE-plus-sandbox-escape-plus-privilege-escalation chain was developed, shared, and adopted by at least four distinct espionage clusters within roughly a week of first observed use, exploiting a patch-gap window between upstream Chromium fixes and downstream stable releases. All clients running unpatched Chromium-based browsers or Windows endpoints are exposed to opportunistic compromise via phishing-delivered links; financial entities in Southeast Asia have already been targeted directly, and Proofpoint assesses proliferation to financially motivated actors is likely. Attribution remains single-sourced to Proofpoint and the "BlueMoon" designation has no MITRE ATT&CK profile in our verified data — treat it as unconfirmed. The immediate action is unambiguous: apply the 3/8 September Chrome updates, the Edge 152.0.4191.62 update, and September 2026 Windows Patch Tuesday, and hunt for chrome.exe → curl.exe process chains since 28 August. We will monitor for atomic IOC release from Proofpoint's full report, evidence of financially motivated adoption, and any expansion of targeting into EMEA.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.