At least four China-linked hacking groups used the same previously unknown Google Chrome exploit kit in real attacks starting in late August 2026. Proofpoint said the shared kit, called BlueMoon, targeted Chrome users at U.S. defense contractors, nonprofits and NGOs, and Southeast Asian government agencies, combining two browser flaws with a Windows privilege-escalation bug to take over victim systems. The underlying Chromium vulnerability had been patched in source code in early August, but a four-week delay before the stable Chrome release created a patch gap the attackers exploited.
info@thehackernews.com (The Hacker News)
2026.09.23
91% relevant
This appears to be a follow-on report on the same underlying campaign, adding that the Chrome-to-Windows exploit chain was used by Chinese threat actors to deploy CLEANGULP malware on victim systems.
info@thehackernews.com (The Hacker News)
2026.09.15
93% relevant
This appears to be a direct update on the same underlying event: China-linked operators using a Chrome-to-Windows exploit chain in real attacks. The new source adds the specific malware payload name GRIMWEDGE and further attribution/operational details about how the exploit chain was used after browser compromise.
Bill Toulas
2026.09.10
96% relevant
This is the same underlying event: multiple espionage groups using a shared 'BlueMoon' exploit kit built around Chrome and Windows zero-days. This source adds the specific CVE chain, the identified clusters JungleBamboo, UTA0560, UNK_LateNight, and UNK_DoubleCheck, and payload details including Grimwedge, ShadowPad, and an in-memory Rust loader.
2026.09.09
95% relevant
This article appears to be a fuller report on the same underlying BlueMoon exploit-kit campaign, adding that Proofpoint saw fewer than 20 organizations targeted globally, identifies TA412/Violet Typhoon as an early user against U.S. NGOs, mining companies, and commodity traders, and names the Windows privilege-escalation bug as CVE-2026-85880 alongside Chromium bug CVE-2026-85046.
info@thehackernews.com (The Hacker News)
2026.09.09
96% relevant
This appears to cover the same underlying event: four espionage groups reusing the same Chrome and Windows exploit kit within a short time window, adding reporting detail about the coordinated or shared exploitation pattern.
2026.09.09
100% relevant
This article establishes a distinct new event: multiple separate China-linked espionage groups shared and used the same Chrome zero-day exploit kit in concurrent real-world attacks, rather than a single vendor patch or a previously tracked Chrome zero-day story.