BlueMoon phishing attacks chained Chrome and Windows zero-days to install espionage malware
BlueMoon used phishing links and three Chrome/Windows flaws to install spying malware on targeted Windows PCs. Fixes are available for Chrome, Edge and affected supported Windows versions. Update browsers and Windows; suspected infections need investigation.
Update Chrome through Help → About Google Chrome, or Edge through Help and feedback → About Microsoft Edge, then relaunch; Chrome 153.0.8010.36 and Edge 152.0.4191.66 are the minimum versions covering both browser flaws. Install all available Windows security updates, and ask IT to replace unsupported Windows versions. If you opened a suspicious link or find an unfamiliar Gemini extension, ask IT or a trusted security specialist to investigate: updating does not remove an existing infection.
- Google Chromefixed in 153.0.8010.36 and later
- Google Chromefixed in 153.0.8010.36 and later
- Google Chromefixed in 153.0.8010.36 and later
- Microsoft Edgefixed in 152.0.4191.66 and later
- Microsoft Edgefixed in 152.0.4191.66 and later
- Microsoft Edgefixed in 152.0.4191.66 and later
- Windows 10 Version 1607fixed in 10.0.14393.9512 and later
- Windows 10 Version 1809fixed in 10.0.17763.9245 and later
- Windows 10 Version 21H2fixed in 10.0.19044.7725 and later
- Windows 10 Version 22H2fixed in 10.0.19045.7725 and later
What’s happening
BlueMoon is an exploit kit used in targeted espionage attacks first observed by Proofpoint on 28 August. Phishing links led to pages that combined two Chrome V8 flaws with a Windows privilege-escalation flaw to install malware on older Windows systems. Initial targets included people at US NGOs, mining companies and commodity trading firms; Proofpoint subsequently identified four clusters using the kit. Volexity independently documented NGO targeting, including emails sent to personal and work addresses. Payloads included backdoors and a fake Google Gemini extension that stole credentials and browser sessions. The Chrome flaws had fixes in public Chromium source code before those fixes reached stable Chrome releases. Released fixes are confirmed for Chrome, Edge and Microsoft's listed affected Windows branches; this does not establish fix coverage for every other Chromium browser. Microsoft's Windows record was updated on 31 October. Sources reviewed through 3 November do not establish victim totals or that the campaigns have ended.
- What
- Flaw
- Affects
- Google Chrome and Microsoft Edge on Microsoft Windows
- Affected
- Google Chrome before 152.0.7977.82: CVE-2026-85046
Google Chrome before 153.0.8010.36: CVE-2026-87491
Microsoft Edge before 152.0.4191.62: CVE-2026-85046; before 152.0.4191.66: CVE-2026-87491
Windows 10: 1607 before 10.0.14393.9512; 1809 before 10.0.17763.9245; 21H2 before 10.0.19044.7725; 22H2 before 10.0.19045.7725
Windows Server 2012, including Core: before 6.2.9200.26349
Windows Server 2012 R2, including Core: before 6.3.9600.23398
Windows Server 2016, including Core: before 10.0.14393.9512
Windows Server 2019, including Core: before 10.0.17763.9245
Windows Server 2022: before 10.0.20348.5622 - Fixed in
- Chrome 152.0.7977.82/.83 Windows/macOS; 152.0.7977.82 Linux: CVE-2026-85046
Chrome 153.0.8010.36/.37 Windows/macOS; 153.0.8010.36 Linux: CVE-2026-87491
Edge 152.0.4191.62: CVE-2026-85046; 152.0.4191.66: CVE-2026-87491
Windows 10 1607 / Server 2016: 10.0.14393.9512
Windows 10 1809 / Server 2019: 10.0.17763.9245
Windows 10 21H2: 10.0.19044.7725
Windows 10 22H2: 10.0.19045.7725
Windows Server 2012: 6.2.9200.26349
Windows Server 2012 R2: 6.3.9600.23398
Windows Server 2022: 10.0.20348.5622 - Since
- 28 Aug 2026
Timeline
- Vendor revised
Microsoft updated its Windows CVE record. The current record lists fixed builds for affected Windows 10 and Windows Server branches.
- CISA added
CISA added CVE-2026-87491 to its catalogue of vulnerabilities known to be exploited.
- Made public
Proofpoint publicly described BlueMoon and four espionage clusters using it. One campaign installed GemStone, a malicious browser extension impersonating Google Gemini that stole credentials and monitored browsing.
- New fixFixed
Microsoft published CVE-2026-85880 and Windows security fixes. CISA added the Windows flaw to its exploited-vulnerability catalogue that day.
- New fixPartly fixed
Google released Chrome 153.0.8010.36/.37 for Windows and Mac and 153.0.8010.36 for Linux, fixing CVE-2026-87491. Google confirmed this flaw was also being exploited.
- New fixPartly fixed
Microsoft released Edge 152.0.4191.66 with a fix for CVE-2026-87491. Its 2 September release, 152.0.4191.62, had fixed CVE-2026-85046.
- New fixPartly fixed
Google released Chrome 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, fixing CVE-2026-85046. Google confirmed exploitation.
- Wider attacksPartly fixed
Proofpoint first observed TA412 using BlueMoon against people at US NGOs, mining companies and commodity trading firms. Phishing links delivered malware through Chrome and Windows flaws.
Sources
- Stable Channel Update for Desktop — Chrome 152Google · 3 Sept 2026
- Stable Channel Update for Desktop — Chrome 153Google · 8 Sept 2026
- Microsoft-authored CVE-2026-85880 record, updated 31 OctoberMicrosoft · 31 Oct 2026
- Release notes for Microsoft Edge Security UpdatesMicrosoft · 4 Sept 2026
- CVE-2026-87491: Google description and CISA exploitation assessmentGoogle and CISA · 21 Sept 2026
- Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-DaysProofpoint · 9 Sept 2026
- Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & WindowsVolexity · 9 Sept 2026
- New 'BlueMoon' kit exploited Windows and Chrome zero-day flawsBleepingComputer · 10 Sept 2026