![](http://expert.com.ua/wp-content/uploads/2025/01/giganet_banner-900x90-2.png")
Hacker groups have deployed a new toolkit called “BlueMoon,” which exploits a number of vulnerabilities in the Google Chrome browser and Windows 10 and Windows 11 operating systems to execute remote commands and steal data, bleepingcomputer reports, citing data from cybersecurity company Proofpoint.
Details of the “BlueMoon” attack
According to Proofpoint, since August 28, activity has been observed using this toolkit by the JungleBamboo group (also known as APT31, Violet Typhoon). Later, on September 1, Volexity detected similar attacks, which were attributed to the UTA0560 group. These attacks are mainly aimed at non-profit organizations.
Vulnerabilities being exploited
The “BlueMoon” toolkit effectively combines three vulnerabilities:
- CVE-2026-85046: A typical inconsistency in Chrome's V8 JavaScript engine. This vulnerability allows attackers to gain arbitrary memory access inside the V8 sandbox.
- CVE-2026-87491: A vulnerability that allows you to escape the V8 sandbox. It can corrupt WebAssembly metadata and execute embedded shellcode.
- CVE-2026-85880: Heap Buffer Overflow in Windows ALPC. This vulnerability is exploited to allow local elevation of privilege on the system.
Distribution methods
The attacks are spread through phishing emails disguised as topics related to donations, business offers, file sharing, or meeting invitations. The goal is to trick users into downloading and running malicious files.
Execution process
Once infected, “BlueMoon” launches exploits in Web Worker, trying up to 5 times. The tool identifies the victim’s device and then exploits Windows vulnerabilities to elevate the privileges of the Chrome renderer. It then injects itself into the parent Chrome process and executes commands provided by the operator.
By default, in addition to privilege escalation, the final command uses the utility curl to download an executable file. This file is usually a malware loader, stored in the directory %TEMP% and then it starts.
Exploit development
Researchers note that developers of such tools use the time between the release of fixes to Chromium and the release of stable versions of Chrome to reverse engineer changes in the code and create exploits based on them.
