Four Espionage Groups Use BlueMoon Exploit Kit to Target Chrome and Windows

At least four espionage groups, several with suspected links to China, are using a new exploit kit named BlueMoon to break into organizational networks in the US and Southeast Asia. Security researchers from Proofpoint discovered the kit, which chains three vulnerabilities together to install malware. The attack chain includes two Chromium based browser flaws, including a V8 type confusion vulnerability (CVE-2026-85046) and a sandbox escape, as well as a Windows privilege escalation vulnerability (CVE-2026-85880). Google and Microsoft have since released patches for these flaws.

Proofpoint researchers noted that the kit was developed and shared among multiple threat actors rapidly. One group, TA412, which is linked to China's Ministry of State Security, targeted non governmental organizations, mining companies, and physical commodity trading firms in the US starting August 28. The researchers observed that the attackers took advantage of a patch gap, which is the window of time between when a fix is committed to the open source Chromium code and when it is released in stable browser versions.

Proofpoint suggests that the rapid deployment and sharing of this high value capability may be driven by the use of AI agents, which can reduce the cost and barrier to entry for exploit development. While the damage currently appears limited, with fewer than 20 organizations globally identified as targets, researchers believe the actual number of victims is likely higher.