A new exploit toolkit called BlueMoon is letting espionage-focused hackers string together three separate vulnerabilities in Chrome browsers and Microsoft Windows to gain full administrative control over targeted computers through a single phishing link, according to research published by Proofpoint, Google's Threat Intelligence Group, Microsoft's Threat Intelligence Center, and cybersecurity firm Volexity. The attack combines two Chrome flaws—a type confusion bug in the V8 JavaScript engine (CVE-2026-85046) and a sandbox escape through WebAssembly (CVE-2026-87491)—with a Windows kernel privilege escalation zero-day affecting older Windows versions (CVE-2026-85880). All three carry high-severity ratings, and together they enable attackers to execute any code they choose and install malware once a victim clicks a malicious link.
The BlueMoon toolkit was built, put into action quickly, and distributed among several hacking groups within just days, Proofpoint noted, generating strong indicators that defenders could detect. One China-aligned state-sponsored group deployed BlueMoon starting August 28 to target a handful of non-governmental organizations, mining firms, and commodity trading companies in the United States through spear phishing. The attackers posed as university students seeking internships, sent conference invitations, and even conducted rapport-building conversations tailored to their targets to trick them into clicking phishing links. When victims clicked, they saw a loading screen for several seconds while the exploit ran, then were redirected to legitimate sites such as GitHub. Within days of that initial campaign, several other espionage-motivated hacking clusters—most with suspected ties to China—began using the same BlueMoon toolkit.
Both Chrome vulnerabilities exploited in BlueMoon are what researchers call "patch-gap" zero-days: they were identified and fixed in Chromium's public upstream source code but remained unpatched in later stable releases of Chrome and Chromium-based browsers, the Proofpoint team explained. CVE-2026-85046 was first reported to the Chromium project by a security researcher on August 4, and a fix was added to the open-source codebase that underpins Google Chrome and similar browsers. However, because the repair hadn't yet reached newer Chrome versions, an "unusual patch gap" emerged. The report states that a fully weaponized Chrome exploit chain "has historically been a high-value, rare capability." At the Chromium source level the flaw was an N-day vulnerability—known with an available patch—but in Google Chrome itself it functioned as a zero-day, or previously unknown flaw.
Seva Ioussoufovitch, senior research analyst at Info-Tech Research Group, explained that linking the two Chrome bugs lets attackers run any code inside Chrome through a phishing click, but adding the Windows kernel exploit "exponentially worsens the impact" by elevating privileges on older Windows installations including Windows 10 22H2 and Windows 11 21H2. "Basically, BlueMoon enables threat actors to gain full Windows admin privileges in one click, and install whatever malware they want on an endpoint," he said. Proofpoint predicted BlueMoon will "likely proliferate further and be adopted by both espionage-motivated and financially motivated threat actors." Nick Tausek, lead security automation architect at Swimlane, pointed out that BlueMoon's use across four separate attack clusters makes it appear "less like a specialized weapon and more like reusable infrastructure," with modular design allowing different groups to pursue different goals without rebuilding the attack chain from scratch. The window for exploitation has narrowed dramatically because threat actors, whose capacity to build exploit kits has been "wildly accelerated" by AI, now have time to reverse engineer exploits from open-source code and capitalize on what once seemed like a reasonable patch delay, Ioussoufovitch noted, adding that "attackers are acting faster, and that means each day a patch is delayed carries more risk than it used to."
For this specific attack, the remedy is clear: patch Chrome and Windows right away, apply the detection rules Proofpoint has shared, and rescan infrastructure for any remnants tied to the toolkit, because items installed by BlueMoon—such as Chrome extensions, scheduled tasks, or registry keys—won't disappear when patches are applied, Ioussoufovitch said. More broadly, he said the industry must stay on high alert, vendors are patching more quickly, and organizations need to speed up their own patching cycles to match. Since many of these attacks still rely on social engineering, awareness training remains important, though he acknowledged that "realistically though, the pace of AI advancement is making user awareness training a losing battle." The accelerating speed at which adversaries can reverse engineer fixes and deploy reusable exploit infrastructure is forcing organizations to rethink whether traditional patch timelines and user training can keep pace with automation-assisted offense. Security teams may need to weigh the operational friction of near-instant patching against the rising probability that even short delays now offer attackers a tactical advantage they didn't have a year ago.