Multiple China-aligned espionage groups used phishing emails to deliver a “BlueMoon” exploit chain that abused three zero-day flaws in Chrome/Chromium and Windows. In observed campaigns, victims who clicked the phishing link ended up with a malicious browser extension disguised as Google Gemini, enabling surveillance, credential theft, and remote command execution. Proofpoint says the activity is ongoing and may spread to more threat actors.
Proofpoint identified at least four China-aligned espionage groups using a chained set of browser and Windows zero-day vulnerabilities, referred to as BlueMoon. One of these groups, APT31 (also tracked as TA412 or Violet Typhoon), delivered phishing emails containing lures with an exploit chain loader. Victims who clicked the embedded link ended up installing a malicious browser extension disguised as Google Gemini. Once active, the extension gave attackers the ability to surveil browser activity, steal credentials, and execute commands remotely on the compromised machine.
The lure worked because it leveraged the credibility of a well-known AI product name to make the extension prompt feel legitimate. Employees who are used to seeing browser extension prompts or software update notifications may not pause to verify the source before clicking. The campaign infrastructure was also fast-moving, with exploit-delivery setups created the same day as or shortly before campaigns launched, reducing the window for detection or blocklisting.
The use of three flaws that functioned as zero-days, meaning they were exploited before public patches existed, also meant that even technically current systems could be compromised if a user completed the phishing action.
Organizations should reinforce that browser extensions should only be installed through approved, IT-managed channels rather than links in email. Staff across all levels, including executives, finance, engineering, and NGO program staff, should be trained to treat unsolicited extension or update prompts as suspicious by default. Rapid patching remains important, since these flaws were exploited before public fixes were released. Finally, awareness training should note that even messages from seemingly credible accounts, including government accounts, can be compromised and used to distribute convincing phishing lures. Techniques referenced in this campaign map to MITRE ATT&CK entries such as T1566.002 for spearphishing links and T1204.001 for user execution via malicious link.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
BlueMoon is a chained set of browser and Windows zero-day vulnerabilities that Proofpoint observed at least four China-aligned espionage groups using, including APT31/TA412.
APT31 sent phishing emails with lures containing an exploit chain loader that led victims to click a link installing a malicious browser extension disguised as Google Gemini.
Once installed, the extension enabled attackers to surveil browser activity, steal credentials, and execute commands on the victim's machine.
Targets included NGOs, mining companies, commodity trading firms, aerospace companies, and organizations in government, consulting, and finance across multiple countries.
You get an email: “New Google Gemini extension required for secure browsing, install now.” Looks legit, right? Behind that link is BlueMoon: a chained Chrome and Windows zero‑day attack used by APT31 to drop a fake Gemini extension that spies on your browsing, steals passwords, and runs commands on your machine. Here’s the tell: Gemini doesn’t arrive as a random email link. If a message, even from a government or partner address, pushes you to install or enable a browser extension, that’s a high‑risk red flag. If any email tells you to add a browser extension like Gemini, stop. Don’t click, open a ticket or message IT and ask them to push it through the approved store instead.
Proofpoint reports multiple China-aligned espionage groups used a chained set of browser/Windows zero-days (“BlueMoon”) and delivered it through phishing emails. Victims who clicked a phishing link could end up with a malicious browser extension disguised as Google Gemini, letting attackers watch…
Researchers reported two China-linked groups targeting NGOs with spear-phishing that led victims through a legitimate U.S. university website before redirecting them to attacker infrastructure. The attackers used a chained Chrome/Windows exploit to take control, then deployed different payloads,…
Researchers found multiple espionage groups using the same Chrome+Windows exploit kit (“BlueMoon”) within days of each other. The groups sent realistic phishing emails (internship requests, conference outreach, procurement inquiries, and vaccination appointments) that pushed victims to click links…
Microsoft and partners disrupted three "phishing-as-a-service" kits that enabled criminals to send more than a billion phishing emails and SMS messages worldwide. The kits provided ready-made fake brand pages (government, finance, logistics, consumer brands) designed to steal login credentials and…
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem (YAM Store, CoGUI, and Iron Man) that enabled criminals to send over a billion malicious messages globally. The services sold phishing kits, compromised accounts, and infrastructure, and were frequently used to…
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
