BlueMoon Exploit Kit Chains Chrome and Windows Zero-Day Vulnerabilities

A new modular exploit kit, dubbed “BlueMoon”, has been identified by security researchers using a chain of zero-day vulnerabilities in Google Chrome and Microsoft Windows to facilitate cyber-espionage operations.

The kit enables attackers to achieve remote code execution (RCE) and sandbox escape within Chromium-based browsers, followed by local privilege escalation (LPE) within the Windows operating system.

Technical breakdown of the attack chain

Researchers from cybersecurity firm Proofpoint and threat intelligence company Volexity observed the kit being deployed in several distinct campaigns. The BlueMoon exploit chain leverages three specific vulnerabilities to compromise a system:

• CVE-2026-85046: A type-confusion flaw in the Chrome V8 JavaScript engine that allows for arbitrary memory access inside the V8 sandbox.
• CVE-2026-87491: A V8 sandbox escape vulnerability that corrupts WebAssembly metadata to run embedded shellcode.
• CVE-2026-85880: A heap-based buffer overflow in the Windows ALPC mechanism that allows for local privilege escalation.

Proofpoint noted that the Windows LPE component (CVE-2026-85880) may have been a long-standing zero-day, with compilation timestamps suggesting the vulnerability may have been exploited since 2025 before being repackaged into the BlueMoon kit.

The exploit functions by running within a Web Worker, attempting the attack up to five times. After fingerprinting the target system, the kit uses the Windows privilege escalation flaw to elevate the Chrome renderer and inject code into the browser’s parent process. Once control is established, the kit typically executes a command to use curl to download and run a malware loader from the %TEMP% directory.

Targeted threat actors and sectors

The deployment of BlueMoon has been linked to at least four distinct clusters of activity, three of which appear to be China-aligned or state-sponsored.

The first group, JungleBamboo (also known as APT31 or Violet Typhoon), has been observed using the kit in spearphishing operations targeting non-governmental organisations (NGOs), mining companies, and high-value individuals. Volexity also identified a second group, UTA0560, which used similar tactics to target NGOs through donation-themed lures.

Other observed activity includes:

• UNK_LateNight: A group targeting the United States aerospace and defence-industrial base with the ShadowPad backdoor.
• UNK_DoubleCheck: An actor targeting manufacturing firms in Vietnam using an in-memory Rust loader.

Security researchers expect the adoption of the BlueMoon kit to increase, noting that its modular design could eventually allow financially motivated cybercriminals to utilise the same tools. Organisations are advised to monitor for the indicators of compromise (IoCs) identified by Proofpoint and Volexity to defend against these targeted campaigns.