BlueMoon Exploit Kit Chains Chrome and Windows Vulnerabilities in Cyber-Espionage Attacks

Cybersecurity researchers have uncovered a sophisticated exploit kit known as “BlueMoon” that combines vulnerabilities in Google Chrome and Microsoft Windows to compromise targeted computer systems.

According to investigations by Proofpoint and Volexity, the toolkit has been deployed by multiple cyber-espionage groups. Proofpoint observed BlueMoon activity from August 28, while Volexity identified similar operations in early September targeting customers at non-governmental organisations.

The attack framework links three vulnerabilities. Two affect the V8 JavaScript engine used by Chromium-based browsers, enabling attackers to gain memory access and escape browser security restrictions. A third vulnerability, CVE-2026-85880, affects Windows and can be exploited to obtain elevated system privileges.

Researchers found that BlueMoon can identify characteristics of the targeted system before attempting exploitation. Once successful, the attack can move beyond the browser environment, elevate privileges and execute commands selected by the attacker. The default infection process can download and run additional malicious software on the compromised machine.

Proofpoint believes the Windows vulnerability may have been available to attackers before becoming publicly known, making it particularly significant as a zero-day exploitation case.

Several threat clusters have been associated with BlueMoon campaigns. Reported targets include NGOs, aerospace and defence organisations, mining companies and manufacturing businesses.

Researchers have warned that the modular nature of BlueMoon could allow additional exploits to be incorporated over time. They also expect its use to expand beyond the groups currently deploying it, potentially making the toolkit available to a wider range of cybercriminal operations.

10-09-2026