Researchers found multiple espionage groups using the same Chrome+Windows exploit kit (“BlueMoon”) within days of each other. The groups sent realistic phishing emails (internship requests, conference outreach, procurement inquiries, and vaccination appointments) that pushed victims to click links which silently exploited the browser and installed malware. The activity targeted NGOs and commercial firms as well as government and finance organizations across several countries.
Researchers observed four separate espionage groups using the same Chrome and Windows exploit kit, referred to as BlueMoon, within about a two week window. Each group relied on phishing emails built around believable business or academic pretexts rather than obvious malicious content. One cluster, TA412, posed as university students seeking internships or as outreach tied to an academic conference. A second cluster, UNK_LateNight, sent fake RFQ and procurement inquiry emails to aerospace and defense companies. A third cluster, UNK_DoubleCheck, used a compromised government email account to send a vaccination appointment lure to a manufacturing company.
In each case, the goal was the same: get the recipient to click a link. Once clicked, the exploit kit ran silently in the background while the browser redirected to a legitimate looking site, making the compromise difficult to notice in the moment.
The lures worked because they matched normal business and personal expectations. An internship request, a procurement inquiry, or a vaccination reminder are all plausible emails that many staff receive routinely. None of them look overtly suspicious on their own, and the redirect to a legitimate site after clicking removed the usual visual cue that something went wrong. This combination of believable pretext and clean-looking technical behavior let the exploit run before anyone had reason to suspect an issue.
Organizations across NGOs, mining, commodity trading, aerospace and defense, manufacturing, government, consulting, and financial services were all represented in the affected industries here, showing how broadly these pretexts can be reused. Staff in procurement, finance, sales, HR, and executive assistant roles should verify unexpected internship, RFQ, or appointment requests through a separate trusted channel before clicking any link. Security teams should also treat vendor guidance about actively exploited zero-days as urgent, particularly for browsers and Windows systems on older builds, since the privilege escalation piece of this chain was patched as an actively exploited flaw in a recent Patch Tuesday release. Reinforcing awareness around unexpected link clicks and unfamiliar browser extensions can reduce the chance that a single click leads to silent compromise.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
BlueMoon is the name given to a Chrome plus Windows exploit kit that four separate espionage groups adopted within roughly two weeks of each other.
Victims received phishing emails with believable pretexts like internship requests, conference outreach, RFQ inquiries, or vaccination appointments. Clicking the included link silently triggered exploitation while the browser redirected to a legitimate site.
A quick redirect to a legitimate-looking site after a link click can mask background exploitation, so that behavior itself should be treated as a red flag.
The Windows privilege escalation component used in this chain targeted older builds and was patched as an actively exploited zero-day in the September 2026 Patch Tuesday, so applying that update is urgent.
You get an email: "Subject: Internship inquiry – Association for Asian Studies outreach." Looks legit, right? Behind that click is BlueMoon, a Chrome plus Windows exploit kit. It silently hits your browser, then bounces you to a real university site while malware installs in the background. Same trick hits procurement: "Subject: RFQ – request for pricing and availability." Click, quick redirect, then a fake "AI-powered browsing companion by Google Gemini" extension called GemStone quietly lands on your machine. If an unexpected internship, conference, or RFQ email wants you to click a link, stop. Don’t click, forward it to security and confirm through your usual channel instead.
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Proofpoint reports multiple espionage-focused threat groups used a shared exploit kit (“BlueMoon”) after tricking targets with spear-phishing emails to click malicious links. Visiting the attacker-controlled web pages triggered Chrome and Windows exploits to install malware (including a fake…
Researchers described iAuthFlow v2, a phishing toolkit that steals a live Google login session and then uses that access to enroll an attacker-controlled passkey. Because passkeys are separate login methods, the attacker can often get back into the account even after the victim changes their…
Google says multiple suspected Russia-linked espionage clusters targeted academics, government, and defense-related personnel by abusing legitimate sign-in features instead of using obvious fake login pages. The campaigns used realistic lures (file sharing, conference invites, and “secure WhatsApp”…
Google says three suspected Russian espionage clusters are targeting academics, think tanks, diplomats, and related nonprofit staff by abusing legitimate login and verification workflows that may not look like “classic phishing.” The campaigns include app-password scams, OAuth/device-code tricks,…
