Multiple China-aligned espionage groups used phishing emails to deliver a “BlueMoon” exploit chain that abused three zero-day flaws in Chrome/Chromium and Windows. In observed campaigns, victims who clicked the phishing link ended up with a malicious browser extension disguised as Google Gemini, enabling surveillance, credential theft, and remote command execution. Proofpoint says the activity is ongoing and may spread to more threat actors.
Proofpoint identified at least four China-aligned espionage groups using a chained set of browser and Windows zero-day vulnerabilities, referred to as BlueMoon. One of these groups, APT31 (also tracked as TA412 or Violet Typhoon), delivered phishing emails containing lures with an exploit chain loader. Victims who clicked the embedded link ended up installing a malicious browser extension disguised as Google Gemini. Once active, the extension gave attackers the ability to surveil browser activity, steal credentials, and execute commands remotely on the compromised machine.
The lure worked because it leveraged the credibility of a well-known AI product name to make the extension prompt feel legitimate. Employees who are used to seeing browser extension prompts or software update notifications may not pause to verify the source before clicking. The campaign infrastructure was also fast-moving, with exploit-delivery setups created the same day as or shortly before campaigns launched, reducing the window for detection or blocklisting.
The use of three flaws that functioned as zero-days, meaning they were exploited before public patches existed, also meant that even technically current systems could be compromised if a user completed the phishing action.
Organizations should reinforce that browser extensions should only be installed through approved, IT-managed channels rather than links in email. Staff across all levels, including executives, finance, engineering, and NGO program staff, should be trained to treat unsolicited extension or update prompts as suspicious by default. Rapid patching remains important, since these flaws were exploited before public fixes were released. Finally, awareness training should note that even messages from seemingly credible accounts, including government accounts, can be compromised and used to distribute convincing phishing lures. Techniques referenced in this campaign map to MITRE ATT&CK entries such as T1566.002 for spearphishing links and T1204.001 for user execution via malicious link.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
BlueMoon is a chained set of browser and Windows zero-day vulnerabilities that Proofpoint observed at least four China-aligned espionage groups using, including APT31/TA412.
APT31 sent phishing emails with lures containing an exploit chain loader that led victims to click a link installing a malicious browser extension disguised as Google Gemini.
Once installed, the extension enabled attackers to surveil browser activity, steal credentials, and execute commands on the victim's machine.
Targets included NGOs, mining companies, commodity trading firms, aerospace companies, and organizations in government, consulting, and finance across multiple countries.
You get an email: “New Google Gemini extension required for secure browsing, install now.” Looks legit, right? Behind that link is BlueMoon: a chained Chrome and Windows zero‑day attack used by APT31 to drop a fake Gemini extension that spies on your browsing, steals passwords, and runs commands on your machine. Here’s the tell: Gemini doesn’t arrive as a random email link. If a message, even from a government or partner address, pushes you to install or enable a browser extension, that’s a high‑risk red flag. If any email tells you to add a browser extension like Gemini, stop. Don’t click, open a ticket or message IT and ask them to push it through the approved store instead.
Researchers found multiple espionage groups using the same Chrome+Windows exploit kit (“BlueMoon”) within days of each other. The groups sent realistic phishing emails (internship requests, conference outreach, procurement inquiries, and vaccination appointments) that pushed victims to click links…
Multiple suspected China-linked espionage groups used a new exploit kit (“BlueMoon”) that starts with phishing emails and a malicious link to break into organizations in the US and Southeast Asia. Clicking the link can trigger browser and Windows vulnerabilities to install surveillance tools,…
Proofpoint reports multiple espionage-focused threat groups used a shared exploit kit (“BlueMoon”) after tricking targets with spear-phishing emails to click malicious links. Visiting the attacker-controlled web pages triggered Chrome and Windows exploits to install malware (including a fake…
Proofpoint reported at least four espionage groups (mostly linked to Chinese state intelligence) using the same Chrome zero-day exploit kit (“BlueMoon”) to compromise victims and deliver malware. The operations used believable business and event-themed lures (internship inquiries, procurement…
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
