China-linked attackers targeted NGOs with spear-phishing emails that urged recipients to click a link to a legitimate U.S. university website. The link path abused a website flaw to silently redirect victims to attacker infrastructure, which then exploited Chrome and Windows to install malware (including the GRIMWEDGE backdoor). The campaign shows how a “safe-looking” link to a real website can still lead to compromise.
This campaign began with a spear-phishing email sent to NGO staff on September 1, 2026. The email encouraged recipients to click a link pointing to the website of a legitimate U.S.-based university, a detail that made the message feel low risk. Instead of landing on ordinary university content, the link abused a reflected cross-site scripting flaw on that site, silently redirecting the victim to attacker-controlled infrastructure. That infrastructure hosted a multi-stage exploit chain targeting Chrome and Windows, ultimately achieving code execution and deploying the GRIMWEDGE JavaScript backdoor. GRIMWEDGE polled a command and control server and supported commands for reconnaissance, file access, and running additional tooling.
A second campaign observed using the same exploit chain installed LONGTALE, a credential-stealing Chrome extension that masquerades as a Google Gemini extension to avoid detection.
The attack succeeded because every visible element looked legitimate. The destination link pointed to a real, trusted university domain, not a lookalike or newly registered site. Because the compromise happened through a redirect chain hidden behind a legitimate page, most recipients would have no visual cue that anything was wrong. The exploit chain then relied on Chrome and Windows vulnerabilities rather than requiring the victim to enter credentials or open a suspicious attachment, removing the usual points where a cautious user might hesitate.
Organizations, especially NGOs and advocacy or research teams that are frequent targets, should train staff to treat unexpected links as risky even when the destination domain looks trustworthy, and to verify unusual requests through a separate, trusted channel before clicking. Staff should be encouraged to report odd browser behavior or unsolicited extension prompts to IT immediately rather than dismissing them. Because this campaign relied on a patch-gap window, where exploited flaws are addressed after attackers already use them, keeping browsers and operating systems updated as quickly as possible narrows the time attackers have to exploit known issues. IT and helpdesk teams should coordinate rapid patch rollout and maintain clear reporting channels so suspicious activity can be investigated quickly.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The link abused a reflected cross-site scripting flaw on the university website, which silently redirected victims to attacker-controlled infrastructure hosting a multi-stage exploit chain targeting Chrome and Windows.
The exploit chain deployed the GRIMWEDGE JavaScript backdoor, which polled a command and control server for commands like reconnaissance and file access. A second actor used the same chain to install LONGTALE, a credential-stealing Chrome extension disguised as a Google Gemini extension.
It combined spear-phishing with a website vulnerability, a browser and OS exploit chain, and a patch-gap window, all chained together to gain code execution without obvious warning signs to the victim.
Watch for unusual browser behavior such as crashes, blank pages, or repeated loading, and be suspicious of any unexpected prompt to install or enable a browser extension after clicking an emailed link.
You get an email: “Please review the information at this university page and let us know your feedback.” Looks harmless, right? In a real attack, that link went to an actual U.S. university site, then abused a reflected XSS bug to silently bounce people to ocr.opusaccel.top, where Chrome and Windows exploits dropped the GRIMWEDGE backdoor. Another group reused the same chain to push LONGTALE, a fake “Google Gemini” Chrome extension that steals cookies and logins. Aha: the dangerous part wasn’t the email text or the university name, it was the redirect after you clicked. If an email link to a “legit” site suddenly redirects, crashes, or pops an extension install, stop and report it to security immediately, don’t keep clicking.
Researchers found multiple espionage groups using the same Chrome+Windows exploit kit (“BlueMoon”) within days of each other. The groups sent realistic phishing emails (internship requests, conference outreach, procurement inquiries, and vaccination appointments) that pushed victims to click links…
Proofpoint reports that multiple espionage-focused groups are using a shared “BlueMoon” toolkit to run targeted spear‑phishing campaigns that trick people into clicking a link. A single click can trigger a Chrome/Windows exploit chain that gives attackers full Windows admin access and lets them…
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
Google says multiple suspected Russia-linked espionage clusters targeted academics, government, and defense-related personnel by abusing legitimate sign-in features instead of using obvious fake login pages. The campaigns used realistic lures (file sharing, conference invites, and “secure WhatsApp”…
Google says three suspected Russian espionage clusters are targeting academics, think tanks, diplomats, and related nonprofit staff by abusing legitimate login and verification workflows that may not look like “classic phishing.” The campaigns include app-password scams, OAuth/device-code tricks,…
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
