New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws
Recorded: Sept. 10, 2026, 3:10 p.m.
| Original | Summarized |
New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws News Featured AdaptHealth confirms 4.1 million people exposed in July cyberattack Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days Over 36,000 exposed Plex servers vulnerable to recent flaws New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access IDScan confirms breach tied to 153 million stolen driver’s licenses New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws The Top 4 Threats We Found by Investigating Every Alert for a Quarter Microsoft says September updates fix mouse settings reset issues Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityNew 'BlueMoon' kit exploited Windows and Chrome zero-day flaws New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws By Bill Toulas September 10, 2026 Multiple cyber-espionage groups deployed an exploit kit dubbed “BlueMoon” that leveraged zero-day vulnerabilities in Microsoft Windows and Google Chrome. BlueMoon attack chain overviewSource: Proofpoint Phishing emails used in the attacksSource: Proofpoint Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Related Articles: Actively Exploited Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Upcoming Webinar Popular Stories Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access Sponsor Posts See how attackers exploit passkey enrollment, and why hardware-bound biometrics raise enterprise identity assurance. Overdue a password health-check? Audit your Active Directory for free EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Multiple cyber-espionage groups utilize an exploit kit named BlueMoon, which leverages zero-day vulnerabilities in Microsoft Windows and Google Chrome to achieve system compromise. This exploit kit is characterized as a shared, modular tool that successfully chains together security issues in Chromium-based browsers with a local privilege escalation flaw in Windows. Researchers at Proofpoint and Volexity observed the deployment of BlueMoon in spearphishing operations attributed to actors such as JungleBamboo, associated with China, and UTA0560, which targeted non-governmental organizations. The methodology employed by the developers of BlueMoon involves exploiting the time delay between public browser security fixes and stable releases to reverse-engineer public code changes, enabling them to craft exploits targeting end-users. The exploit chain relies on three specific vulnerabilities: CVE-2026-85046, a type-confusion flaw within Chrome’s V8 JavaScript engine that permits arbitrary memory access inside the V8 sandbox; CVE-2026-87491, a sandbox escape vulnerability that corrupts WebAssembly metadata to allow the execution of embedded shellcode; and CVE-2026-85880, a heap-based buffer overflow in the Windows ALPC that facilitates local privilege escalation. Proofpoint noted that the local privilege escalation vulnerability was suspected to have been leveraged since 2025 and repackaged within the BlueMoon kit. The operation of the BlueMoon exploit kit involves executing the exploit within a Web Worker, which fingerprints the system before exploiting the Windows privilege elevation flaw to escalate privileges to the Chrome renderer. From there, the exploit injects commands into Chrome’s parent process, allowing the attacker to execute a command selected by the operator. The default command utilized by the kit typically involves using curl to save an executable, usually a malware loader, into the temporary directory and subsequently running it. The observations from cybersecurity firms identified four distinct activity clusters associated with the BlueMoon deployments. The first cluster involved JungleBamboo, a state-sponsored actor known for targeting NGOs, mining companies, and high-value targets using credential stealers. The second cluster tracked by Volexity involved the UTA0560 group, which used donation lures to infect NGOs and deploy Grimwedge, an in-memory JScript backdoor for reconnaissance, file and process management, command execution, and payload uploads. The third cluster was tracked as UNK_LateNight, which deployed the ShadowPad backdoor on systems belonging to U.S. aerospace and defense-industrial-base companies. Finally, the fourth group, UNK_DoubleCheck, targeted Vietnamese manufacturing firms by deploying an in-memory Rust loader, although the final payload remains unanalyzed. Defenders are advised to utilize the indicators of compromise shared by these cybersecurity companies to proactively block the activity related to the BlueMoon exploit kit. Furthermore, the report contextualizes defensive posture by noting that once attackers possess valid credentials, prevention efficacy drops significantly, as only thirty-seven percent of their subsequent actions are blocked. |