Researchers say a China-aligned group (UTA0565) sent phishing emails to government targets and used multiple fake websites to lure victims into visiting pages that triggered a Chrome-and-Windows zero-day exploit chain. The messages used political advocacy themes and spoofed well-known organizations to lower suspicion, then relied on unpatched software flaws to gain access.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Please publicly support imprisoned Hong Kong activist Chow Hang‑tung. Read the statement here.” Looks legit, right? But researchers at Volexity found a group called UTA0565 using emails like this, plus fake sites that copy real content, to silently exploit Chrome and Windows with a zero‑day chain called CLEANGULP. Here’s the twist: the page looks exactly like Center for American Progress or China Digital Times because it’s using their real content as a decoy, while hidden code hits unpatched Chrome and Windows in that tiny patch gap. If an advocacy or news email pushes you to click, don’t. Open your browser, type the organization’s URL yourself, and go there directly.
China-linked actor UTA0565 sent phishing emails that pushed recipients to click spoofed links to fake media/NGO websites. Visiting the sites triggered a Chrome-to-Windows zero-day exploit chain that escaped the browser sandbox and installed CLEANGULP malware for remote control.
Researchers reported two China-linked groups targeting NGOs with spear-phishing that led victims through a legitimate U.S. university website before redirecting them to attacker infrastructure. The attackers used a chained Chrome/Windows exploit to take control, then deployed different payloads,…
China-linked attackers targeted NGOs with spear-phishing emails that urged recipients to click a link to a legitimate U.S. university website. The link path abused a website flaw to silently redirect victims to attacker infrastructure, which then exploited Chrome and Windows to install malware…
Researchers found multiple espionage groups using the same Chrome+Windows exploit kit (“BlueMoon”) within days of each other. The groups sent realistic phishing emails (internship requests, conference outreach, procurement inquiries, and vaccination appointments) that pushed victims to click links…
The article describes multiple real-world social engineering operations this week, including phishing sent from a legitimate Trezor newsletter channel and malware pushed through a verified HBO Max Reddit ad account. It also highlights a large-scale network of fake online stores impersonating real…
Proofpoint reports multiple China-aligned espionage groups used a chained set of browser/Windows zero-days (“BlueMoon”) and delivered it through phishing emails. Victims who clicked a phishing link could end up with a malicious browser extension disguised as Google Gemini, letting attackers watch…
