Four Spy Groups Used the Same Chrome Exploit Kit in One Week. Here’s How BlueMoon Works.

Proofpoint published research this month documenting four distinct espionage groups deploying the same exploit kit against targets across the US, Vietnam, Indonesia, and Singapore. The kit chains a Chrome V8 type confusion bug, a V8 sandbox escape, and a Windows kernel privilege escalation into a single delivery chain. All four groups started campaigns within the same week.

They're calling it BlueMoon. The speed of adoption tells you something about where exploit development is headed.

The Chain

BlueMoon exploits three vulnerabilities in sequence. Each one hands off to the next, and the whole thing runs from a single phishing link to code execution in under a minute.

CVE-2026–85046: Chrome V8 Type Confusion. The first stage targets V8's TurboFan JIT compiler. The vulnerability exploits a type confusion during array sorting operations, which lets the attacker leak object addresses and forge fake pointers. That gives arbitrary read/write within the V8 heap. This is the entry point: the user clicks a link, Chrome renders JavaScript, and the exploit fires in the renderer process.

CVE-2026–87491: V8 Sandbox Escape. V8 has sandboxing that's supposed to contain renderer-level compromises. This CVE breaks that containment by corrupting WebAssembly module metadata, which lets the attacker overwrite WebAssembly function bodies with arbitrary shellcode. The exploit transitions from JavaScript-land to native code execution within the renderer.

CVE-2026–85880: Windows Kernel LPE. The final stage uses an Advanced Local Procedure Call (ALPC) and Windows Notification Facility (WNF) based local privilege escalation to break out of the renderer sandbox entirely. A reflectively loaded DLL fingerprints the Windows version, build number, and process integrity level before deploying the kernel exploit. The LPE elevates the renderer process, and a process injection into the Chrome broker executes operator-specified commands at system level.

Default configuration: download an executable via curl, run it from a temp directory. From phishing email to system-level code execution, one unbroken chain.

The Patch-Gap Window

Here's what made BlueMoon possible at this scale. CVE-2026–85046 had publicly available Chromium patches before Chrome stable releases included the fix. The source-level patch was visible in the open Chromium repository. The compiled fix hadn't shipped to users yet.

Four spy groups reverse-engineered the same patch. They had the diff. They could see exactly what changed. Working backward from a patch to a proof-of-concept exploit is significantly easier than finding the bug blind. The patch itself is a roadmap: it tells you which function was vulnerable, what the boundary condition was, and how the fix changed the code path.

This is the patch-gap problem. Open-source browsers publish security patches in public version control before those patches reach users through stable channel updates. The window between patch commit and stable release is when the vulnerability is simultaneously known and unpatched. BlueMoon lived in that window.

Four Groups, One Kit, One Week

Proofpoint tracked four separate espionage clusters deploying BlueMoon. Three are assessed as China-aligned. The fourth is unattributed but targets a region consistent with Chinese strategic interests.

TA412 (JungleBamboo / Violet Typhoon / APT31) started first on August 28, 2026. Previously indicted by the US for economic espionage. They targeted US NGOs, mining firms, and commodities traders using phishing lures themed around student internships and academic conferences. Their payload: a Chrome extension called GemStone, disguised as "an AI-powered browsing companion by Google Gemini." GemStone handles keystroke logging, cookie theft, credential exfiltration, and screenshots. C2 runs through Cloudflare Workers with endpoints for remote execution, data capture, and recording toggles.

UNK_LateNight targeted US aerospace companies by spoofing defense procurement communications. Payload: ShadowPad backdoor via DLL sideloading, using HMAC and super_mac forgery to bypass Chrome's Secure Preferences protections.

UNK_DoubleCheck targeted Vietnamese manufacturing through compromised government email accounts. Payload: a Rust-based loader executing RC4-decrypted payloads, using Cloudflare R2 buckets and DNS-over-HTTPS for C2 communication.

UNK_QuietRacket targeted Indonesian and Singaporean government and financial institutions using regional conference themes. Payload: custom .NET assembly loaded in-memory via Cloudflare Workers, communicating over ChaCha20-encrypted channels.

Four different operators. Four different final payloads. Four different target sectors. One shared exploit chain. That distribution pattern suggests either a commercial exploit broker selling the kit to multiple buyers, or a centralized offensive capability shared across aligned groups. Either way, the exploit development cost was amortized across at least four campaigns within days.

The AI Development Question

Proofpoint's analysis flagged several characteristics of BlueMoon's codebase that are potentially consistent with AI-assisted development.

Extensive diagnostic logging capabilities throughout the exploit chain. References to markdown handover documents (including a path docs/v8-ctf-chrome-stage4-handover.md embedded in the code). Detailed comments documenting successive debugging iterations. Default configurations that emphasize functionality over operational security.

None of those markers are conclusive proof of AI involvement. Human developers write comments and logging too. But the combination of characteristics matches the output profile of a development workflow where an AI coding agent iterated on the exploit with a human operator reviewing results. The markdown handover document reference is particularly suggestive. That's the kind of artifact a coding agent generates to document its work between sessions. It's not typical of manual exploit development, where the developer's context lives in their head, not in structured handoff docs.

The infrastructure timeline also suggests rushed development. Campaign infrastructure was created on the same day as initial deployments. That's atypical for mature espionage operations, which usually stage infrastructure weeks or months in advance. It's consistent with a development cycle where the exploit was ready faster than the operational planning.

What This Changes

The strategic implication of BlueMoon isn't the exploit chain itself. Browser exploit chains have existed for years. The V8 type confusion to sandbox escape to kernel LPE pattern is well-established. What's new is the proliferation speed and the development efficiency.

When four groups deploy the same novel chain within a week, one of two things happened: the chain was developed centrally and distributed intentionally, or multiple groups independently reverse-engineered the same patch-gap window and arrived at the same exploit independently. Proofpoint's analysis favors the former. The code-level similarities between deployments are too close for parallel development.

If a single development effort produced a working Chrome zero-day chain and distributed it to at least four operational groups within days, the economics of browser exploitation just shifted. The development cost per campaign dropped by 75% or more. And if AI-assisted development played a role in building the chain, the next one will be faster.

The session storage key v8ctf_exp_attempt found in BlueMoon's artifacts is worth noting. "CTF" in a production exploit kit suggests the development methodology borrowed from capture-the-flag competition approaches. CTF-style exploit development, iterating rapidly on known vulnerability classes with structured methodology, is exactly the workflow where AI coding agents add the most leverage. Give an agent a V8 patch diff, a JIT compiler fuzzing harness, and a prompt that says "build a working exploit from this regression," and you're describing a task frontier models handle measurably well.

Detection and Response

BlueMoon leaves forensic traces at several points in the chain.

Process trees showing chrome.exe spawning cmd.exe spawning curl.exe spawning an executable. That's not normal Chrome behavior. Endpoint detection that alerts on browser-to-shell-to-download chains catches this.

Session storage keys named v8ctf_exp_attempt in the browser's session data. The reflective DLL loading pattern during the kernel LPE stage. Scheduled tasks with names like EdgeCore_AutoUpdate created by the persistence mechanism.

GemStone (TA412's payload) masquerades as a Google Gemini extension. Any Chrome extension claiming to be a Google AI product that wasn't installed from the Chrome Web Store is suspicious by default. Enterprise extension management policies that whitelist specific extension IDs and block sideloading would have stopped GemStone entirely.

The C2 infrastructure runs through Cloudflare Workers across multiple BlueMoon deployments. That's a detection challenge because Cloudflare Workers traffic looks like legitimate HTTPS to most network monitoring. Domain-based blocking won't work when the C2 is a serverless function on a shared platform. Behavioral analysis of extension network traffic, specifically volume, timing, and destination patterns, is the detection layer that applies here.

The Broader Pattern

BlueMoon fits a trend that's been accelerating through 2026. The cost of developing working exploit chains is dropping. The time from patch publication to weaponization is compressing. The number of groups capable of deploying browser zero-days is increasing.

MCP security research documented 40+ CVEs in 60 days earlier this year. The JADEPUFFER ransomware campaign demonstrated fully autonomous exploitation. Anthropic's September threat report showed China-based actors finding a dozen potential zero-days in a single month using AI-assisted analysis. BlueMoon shows that once a chain exists, it proliferates to multiple operators within days.

For anyone running infrastructure that serves web content to targeted users (NGOs, defense contractors, government agencies, financial institutions), the immediate action is patch cadence. Chrome stable channel updates need to deploy within hours, not days. Enterprise browser management that forces auto-update and blocks outdated versions is the single highest-leverage defense against patch-gap exploitation.

For the broader security community, BlueMoon is evidence that the exploit development pipeline is being industrialized. Whether through commercial brokers, shared offensive infrastructure, or AI-assisted development, the barrier to deploying a working browser zero-day chain is lower than it was a year ago. The four groups that used BlueMoon in one week are probably not the last four.

If you want a structured approach to running AI coding agents without exposing your development pipeline, the Claude Code for Developers guide at numbpilled.gumroad.com covers agent architecture, security boundaries, and the operational patterns that hold up under real workloads.

Claude Code for Developers: 21 Productivity Tricks That Save Hours Paid field manual in the AI agents / OpenClaw route. From prompt toy to working system: memory, routing, tools, and…

Some other notable guides:

THE DEAD DROP: Build Your Own Encrypted Infrastructure YOUR CLOUD IS A LIABILITY.Google reads your Drive. 1Password can get breached. Notion sells your notes. Telegram isn't…

The $20 SOC: Build a Tiny Defensive Network Monitor Stop writing vulnerable tools. Start building memory-safe offensive and defensive systems in Rust.WHY THIS GUIDE?70% of…

Thanks for reading- See you tomorrow. Keep pushing forward, in all endeavors.