Proofpoint reports multiple espionage-focused threat groups used a shared exploit kit (“BlueMoon”) after tricking targets with spear-phishing emails to click malicious links. Visiting the attacker-controlled web pages triggered Chrome and Windows exploits to install malware (including a fake “Google Gemini” browser add-on) and establish persistence even after patching.
Multiple espionage-focused threat groups relied on a shared exploit chain called BlueMoon to compromise targets. The starting point was familiar: a spear-phishing email designed to push the recipient toward an attacker-controlled link. Once a victim clicked, the landing page triggered browser and operating system flaws in succession, allowing a loader executable to run without further action from the target. In one variant, that loader installed a browser extension disguised as a legitimate Google Gemini add-on, which functioned as a browser-surveillance and credential-theft backdoor.
The technique worked because it exploited routine behavior rather than obvious deception. Clicking a link in a work email is an everyday action, and the lure content did not need to be elaborate to prompt that click. The addition of a fake extension named after a recognizable AI product added a layer of legitimacy for anyone who noticed an install prompt. Because several distinct groups used the same exploit chain independently, the pattern reflects a broadly effective delivery method rather than a one-off trick tied to a single actor.
Organizations across the affected sectors, including NGOs, mining and commodity trading, aerospace, manufacturing, government, consulting, and financial services, should reinforce that unexpected links deserve scrutiny before any click. Staff should be encouraged to verify unusual requests through a known contact method rather than acting on the email alone. Because patching closes the initial browser vulnerability but does not remove anything already installed, teams should also treat suspected clicks as an incident requiring a persistence check, looking for unfamiliar browser extensions or unexpected scheduled tasks. Building this two-step habit, caution before the click and verification after a suspected one, reduces the practical impact of exploit chains like BlueMoon even when the initial lure succeeds.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
BlueMoon is a shared exploit chain used by multiple espionage-focused threat groups that is triggered when a target clicks a spear-phishing link to an attacker-controlled landing page, exploiting Chrome and Windows flaws to install malware.
After a victim clicked a malicious link, a loader executable installed a browser add-on disguised as Google Gemini, which acted as a browser-surveillance and credential-theft backdoor called GemStone.
No. Patching closes the initial browser exploit entry point, but it does not remove persistence mechanisms already installed, such as the malicious extension or scheduled tasks.
Targets included U.S. NGOs, mining and commodity trading firms, aerospace companies, a Vietnamese manufacturing entity, and government, consulting, and financial organizations in Indonesia and Singapore.
You get an email: “Please review the information at this link.” Looks normal… but that one click can quietly hijack your browser. That link can lead to a BlueMoon exploit page. In seconds, it abuses Chrome and Windows, then drops a fake “Google Gemini” browser extension that spies on your browsing and steals credentials. Here’s the nasty part: even if you patch Chrome later, BlueMoon’s payload can stay, like that GemStone-style extension or scheduled tasks, quietly watching everything you do. If an email link ever leads to a page asking you to install a browser add-on, especially something like “Google Gemini” to view a file, stop and report it to Security immediately.
Researchers found multiple espionage groups using the same Chrome+Windows exploit kit (“BlueMoon”) within days of each other. The groups sent realistic phishing emails (internship requests, conference outreach, procurement inquiries, and vaccination appointments) that pushed victims to click links…
This weekly roundup includes two real social-engineering-driven incidents. Attackers used social engineering to access Apollo Global Management’s cloud platforms and steal sensitive personal data, and separately attempted a ShinyHunters phishing attack against ReliaQuest using a fake SSO login page…
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
Multiple suspected China-linked espionage groups used a new exploit kit (“BlueMoon”) that starts with phishing emails and a malicious link to break into organizations in the US and Southeast Asia. Clicking the link can trigger browser and Windows vulnerabilities to install surveillance tools,…
Multiple China-aligned espionage groups used phishing emails to deliver a “BlueMoon” exploit chain that abused three zero-day flaws in Chrome/Chromium and Windows. In observed campaigns, victims who clicked the phishing link ended up with a malicious browser extension disguised as Google Gemini,…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
