Reported by 4 outlets

Timeline

1. original reporting

   Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days Indicators ext

   www.proofpoint.com · 34d ago · September 9th, 2026

   Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days Indicators ext

   via Mastodon https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit

2. mentioned by www.proofpoint.com

   Proofpoint: Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days Be

   www.proofpoint.com · 34d ago · September 9th, 2026

3. update from malware.news

   BlueMoon exploit kit turns Chrome and Windows flaws into attacks

   malware.news · 33d ago · September 10th, 2026

   BlueMoon , a shared Chrome and Windows exploit kit, shows why “patch later” is becoming a dangerous gamble. Security updates are easy to put off. The browser still opens, Windows still works, and choosing to relaunch your browser or restart your computer later can feel harmless. But a newly documented exploit kit called “BlueMoon” shows how quickly patching delays can become dangerous. Proofpoint Researchers found four espionage groups using the same exploit chain against Chrome browsers running on Windows within days of one another. The campaign is a timely reminder that once a security flaw, or even its fix, becomes public, attackers may move faster than many users expect. The attacks began with phishing emails. A victim who clicked a malicious link could be sent to a web page designed to exploit two vulnerabilities in Chrome’s V8 JavaScript engine, followed by a Windows vulnerability to break out of the browser’s protections and gain higher privileges on the computer. The Chrome vulnerabilities used by BlueMoon were patched in the Stable channel on September 3 and September 8 , 2026. The first was already actively exploited when Google released its update. Microsoft addressed the Windows vulnerabili

4. update from www.malwarebytes.com

   🔒 Security News Digest - 2026-09-10 📊 6 updates from 5 sources: 🦠 Malwarebytes: BlueMoon exploit kit turns Chrome and Windows flaws into att

   www.malwarebytes.com · 33d ago · September 10th, 2026

   🔒 Security News Digest - 2026-09-10 📊 6 updates from 5 sources: 🦠 Malwarebytes: BlueMoon exploit kit turns Chrome and Windows flaws into att

   via Mastodon https://www.malwarebytes.com/blog/bugs/2026/09/bluemoon-exploit-kit-turns-chrome-and-windows-flaws-into-attacks

5. update from securityweek.com

   BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days

   securityweek.com · 31d ago · September 12th, 2026

   Multiple espionage groups have been using a new exploit kit dubbed BlueMoon in seemingly opportunistic and rushed deployments, cybersecurity firm Proofpoint reports. The China-linked APT Violet Typhoon (also tracked as APT31, JungleBamboo, TA412, and Tide Castle) was the first to use it on August 28. Within days, several other Chinese threat actors started using it, but the activity might not be exclusive to China-aligned groups. “It is currently unknown how multiple distinct threat actors obtained access to the exploit kit. Given its ease of adoption, it is likely to proliferate further and be adopted by espionage-motivated and financially motivated threat actors,” Proofpoint notes. Both impact the V8 JavaScript and WebAssembly engine. The Windows zero-day, tracked as CVE-2026-85880, was fixed on September 2026 Patch Tuesday . It is a privilege escalation in Windows Advanced Local Procedure Call (ALPC). BlueMoon, Proofpoint says, exploits the V8 defects for sandbox escape, then fingerprints the host and executes the privilege escalation code. Next, a CreateProcess stub is injected into the parent Chrome broker process to dow