Several state-aligned threat actors have begun using a previously undocumented exploit kit called BlueMoon chaining Chrome and Windows vulnerabilities.
Proofpoint researchers said the first known incident involving BlueMoon was observed in August 2026 and was linked to a China-aligned threat actor, tracked as APT31. Within days, several other espionage groups also began deploying the exploit kit, most of them suspected of having links to China.
BlueMoon exploit chain includes two recently disclosed flaws in Google Chrome’s V8 engine (CVE-2026-85046 and CVE-2026-87491), and CVE-2026-85880 in Windows Advanced Local Procedure Call (ALPC). The Chrome flaws allow attackers to achieve code execution and escape the browser sandbox; the Windows flaw can provide higher system privileges.
“Both V8 vulnerabilities were "patch-gap" zero-days at the time of the observed activity,” Proofpoint said. “In other words, while they were known vulnerabilities already fixed in public upstream Chromium source code, they remained unpatched in the latest stable releases of Chrome and Chromium-based browsers available to the public. It is likely that the exploit kit developer used these publicly available Chromium patches to weaponize the browser exploit chain.”
Researchers said they found several different builds of the BlueMoon exploit kit used by different threat actors. The observed variants included removing comments and diagnostic output, consolidating the kit into a single JavaScript file, encoding or obfuscating its components, and hosting the core exploit code in a separate script. Some deployments also incorporated campaign-specific landing pages and redirects, browser-based operating system checks, and additional telemetry. Despite the differences, all observed samples shared the same exploit chain and loading mechanisms, suggesting they originated from a common source.
Attackers have mainly delivered BlueMoon through phishing emails containing malicious links. Once a victim visits the attacker-controlled site, the exploit chain can compromise Chrome and then gain additional privileges in Windows before downloading malware.
APT31 used the kit against organizations in the US, while other groups targeted aerospace, manufacturing, government, consulting and financial organizations across Asia and the US. The campaigns delivered different malware, including ShadowPad and other custom backdoors.
“It is currently unknown how multiple distinct threat actors obtained access to the exploit kit. Given its ease of adoption, it is likely to proliferate further and be adopted by espionage-motivated and financially motivated threat actors as patched versions are fully rolled out across all Chromium-based browsers,” researchers warned.