Proofpoint reports multiple China-aligned espionage groups used a chained set of browser/Windows zero-days (“BlueMoon”) and delivered it through phishing emails. Victims who clicked a phishing link could end up with a malicious browser extension disguised as Google Gemini, letting attackers watch browsing activity, steal credentials, and run commands.
Multiple China-aligned espionage groups adopted a shared exploit chain, referred to as BlueMoon, shortly after it became usable. One of these groups, tracked as APT31 or TA412, sent phishing emails containing lures that led recipients to click a link. That link installed a malicious browser extension disguised as Google Gemini. Once installed, the extension gave attackers the ability to surveil browser activity, steal credentials, and execute commands on the compromised machine.
The campaign was not limited to a single sector. Proofpoint identified lures targeting non-governmental organizations, mining companies, and commodity trading firms in the United States, alongside U.S. aerospace companies, Vietnamese manufacturing organizations, and government, finance, and consulting entities in Indonesia and Singapore.
Several factors made this campaign effective. The extension impersonated a well-known and trusted product name, which lowered suspicion at the moment of install. The install flow relied on a link in an email rather than an official browser extension store or approved software channel, a pattern that can bypass the instinct many employees have to scrutinize downloads from unfamiliar sources.
In at least one case, attackers used a compromised Southeast Asian government email account to deliver lures to Vietnamese manufacturing organizations. This shows that even messages appearing to come from legitimate organizations or government addresses cannot be assumed safe, since the sending account itself may have been taken over.
Speed also played a role. Because only a limited group of organizations were exposed to all three vulnerabilities in the exploit chain, attackers appear to have rushed development to strike a narrow window before the target pool changed.
Organizations across NGOs, mining, commodity trading, aerospace, manufacturing, government, consulting, and financial services were named as affected in this campaign, and general staff, operations, finance, research, and program staff were all identified as target roles. Employees should be trained to treat any unsolicited request to install an extension or app as high risk, using only approved or official channels for software installs. Because this activity moved quickly and reportedly targeted a narrow pool of organizations at first, prompt reporting of suspicious links is critical so security teams can respond before wider adoption of the same techniques by other threat actors.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Phishing emails from groups including APT31 led victims to click a link that installed a malicious browser extension disguised as Google Gemini, letting attackers surveil browsing, steal credentials, and run commands.
Proofpoint identified targets including U.S. NGOs, mining and commodity trading firms, U.S. aerospace companies, Vietnamese manufacturing organizations, and government, finance, and consulting organizations in Indonesia and Singapore.
Proofpoint observed fewer than 20 organizations directly impacted, but expects the activity and adoption by other threat actors to expand.
Because only a limited group of organizations were exposed to all three vulnerabilities in the chain, attackers rushed development to hit a narrow pool of potential targets before the window closed.
You get an email: “Install the Google Gemini extension.” Looks helpful, even mentions your industry. One click, right? Behind that link is BlueMoon: a chained set of zero‑days used by China‑aligned groups like APT31. It quietly installs a fake “Google Gemini” browser extension that can watch your browsing, steal passwords, even run commands. Proofpoint saw this hitting fewer than 20 orgs so far, NGOs, mining, aerospace, finance, often from real but compromised government or business accounts. The only giveaway? An unexpected email telling you to install a browser extension from a link. If any email tells you to install or enable a browser extension, don’t click. Open your browser’s official store or our approved software portal instead, and report that email to security.
Multiple China-aligned espionage groups used phishing emails to deliver a “BlueMoon” exploit chain that abused three zero-day flaws in Chrome/Chromium and Windows. In observed campaigns, victims who clicked the phishing link ended up with a malicious browser extension disguised as Google Gemini,…
Researchers reported two China-linked groups targeting NGOs with spear-phishing that led victims through a legitimate U.S. university website before redirecting them to attacker infrastructure. The attackers used a chained Chrome/Windows exploit to take control, then deployed different payloads,…
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
Researchers say a China-aligned group (UTA0565) sent phishing emails to government targets and used multiple fake websites to lure victims into visiting pages that triggered a Chrome-and-Windows zero-day exploit chain. The messages used political advocacy themes and spoofed well-known organizations…
The article describes multiple real-world social engineering operations this week, including phishing sent from a legitimate Trezor newsletter channel and malware pushed through a verified HBO Max Reddit ad account. It also highlights a large-scale network of fake online stores impersonating real…
