Cybersecurity researchers have uncovered a sophisticated exploit kit dubbed “BlueMoon” that has been used by multiple cyber-espionage groups to target Windows and Chrome users. The BlueMoon kit takes advantage of zero-day vulnerabilities in Chromium-based browsers, including Google Chrome, and Windows operating systems, making it a highly effective tool for attackers.
The BlueMoon kit is a shared modular tool that allows threat actors to easily add new exploits and use them in their operations. It has been observed being used since August 28 in spearphishing campaigns attributed to the JungleBamboo (also known as APT31) group, which is associated with China. Another threat actor, UTA0560, was also seen using BlueMoon on September 1st to target customers at multiple non-governmental organizations (NGOs).
The BlueMoon kit exploits three zero-day vulnerabilities in Chrome and Windows: CVE-2026-85046, a type-confusion flaw in the V8 JavaScript engine; CVE-2026-87491, a sandbox escape vulnerability that corrupts WebAssembly metadata to run embedded shellcode; and CVE-2026-85880, a heap-based buffer overflow in Windows ALPC that allows local privilege escalation. These vulnerabilities are particularly concerning because they can be exploited even after patches have been released, as the BlueMoon developer maintainers take advantage of the delay between public Chromium fixes and stable Chrome releases.
Once the BlueMoon kit gains access to a system, it uses a Web Worker to run the exploit up to five times, attempting to elevate privileges and inject malware into the Chrome process. The final command typically downloads an executable, usually a malware loader, under the %TEMP% directory and runs it.
The use of BlueMoon has been linked to several threat groups, including JungleBamboo, UTA0560, UNK_LateNight, and UNK_DoubleCheck. These groups have targeted various organizations, including NGOs in the US, mining companies, individual high-value targets, and manufacturing firms in Vietnam.
As a result of these findings, cybersecurity experts are warning that BlueMoon adoption and deployment may increase, potentially reaching financially motivated attackers in the future. To prevent this, defenders are advised to use the provided indicators of compromise (IoCs) in both reports from Volexity and Proofpoint to block the activity early.
In addition to using IoCs, it’s essential for organizations to prioritize patching and updating their systems regularly, as well as implementing robust security measures such as intrusion detection and prevention systems. By staying vigilant and proactive, businesses can reduce the risk of falling victim to BlueMoon attacks and other sophisticated cyber threats.
Source: Bleeping Computer — 2026-09-10