Researchers reported four separate espionage groups using the same “BlueMoon” exploit kit within days, targeting organizations in the US and Southeast Asia. The attacks began with phishing emails that lured recipients to attacker-controlled websites, where Chrome and Windows vulnerabilities were chained to install malware and gain higher system permissions. Even after patching, affected machines may still contain backdoors or other persistence.
Four separate espionage groups were observed using the same BlueMoon exploit kit within about a week of each other, targeting organizations in the US and Southeast Asia. The attack chain began with ordinary phishing emails that directed targets to attacker-controlled websites. Once a victim clicked through in Chrome or a Chromium-based browser, BlueMoon chained browser exploits with a Windows vulnerability to escape the sandbox, elevate privileges, and deliver operator-selected malware.
One of the campaigns, attributed in the reporting to TA412 (also tracked as APT31), targeted NGOs, mining companies, and commodity trading firms with a lure that resulted in the installation of GemStone, a malicious Chrome extension disguised as Google's Gemini AI assistant. Other campaigns deployed different payloads, including ShadowPad and other malware families.
The lure itself was simple: an email prompting the recipient to click a link and view content on a website. There was no need for the message to be elaborate, because the real work happened after the click, inside the browser exploit chain. This makes the initial phishing message harder to flag through content alone, since red flags rely more on context (an unexpected email pushing urgent link-clicking) than on obvious grammar or spoofing errors.
The speed of adoption across four separate groups is also notable. Once one group demonstrated a working exploit chain, others adopted nearly identical code within days, leaving little time between disclosure of a fix and active exploitation in the wild.
Organizations affected or at risk, including NGOs, mining and commodities firms, aerospace, manufacturing, government, consulting, and financial services, should reinforce a few habits. Staff across all roles, not just executives, should treat unsolicited emails with links as high risk, particularly when there is pressure to act immediately. IT and helpdesk teams should reiterate that browser extensions are only installed through approved, official channels. Because patching alone does not remove malware or persistence mechanisms already installed before an update, endpoint checks should follow emergency patches rather than being treated as optional. Fast, clear reporting channels for suspicious browser behavior give defenders a better chance of catching activity during the narrow window between vulnerability disclosure and active exploitation.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
BlueMoon is an exploit kit that chains Chrome and Windows vulnerabilities to escape the browser sandbox and elevate privileges after a victim clicks a phishing link to an attacker-controlled website.
The attacks started with phishing emails that directed targets to attacker-controlled websites, which then triggered the browser-based exploit chain.
GemStone was a malicious Chrome extension disguised as Google's Gemini AI assistant, installed as part of one of the campaigns targeting NGOs, mining companies, and commodity trading firms.
No. Patching closes the vulnerabilities, but it does not remove malware or persistence mechanisms that were already installed on a system before the update, so endpoint checks are still needed.
You get an email: “Please review the information at the link below.” Looks boring, right? That click is all BlueMoon needs. Behind that link is the BlueMoon exploit kit. It hits Chrome, then Windows, and can quietly drop tools like a fake Gemini AI Chrome extension called GemStone. Here’s the scary part: even after we patch Chrome and Windows, BlueMoon’s backdoors and scheduled tasks can still be sitting on that machine, waiting. If you ever click a link and Chrome suddenly asks to install an assistant or extension, stop and hit Report Phishing so IT can check your machine fast.
Multiple suspected China-linked espionage groups used a new exploit kit (“BlueMoon”) that starts with phishing emails and a malicious link to break into organizations in the US and Southeast Asia. Clicking the link can trigger browser and Windows vulnerabilities to install surveillance tools,…
Proofpoint reports multiple espionage-focused threat groups used a shared exploit kit (“BlueMoon”) after tricking targets with spear-phishing emails to click malicious links. Visiting the attacker-controlled web pages triggered Chrome and Windows exploits to install malware (including a fake…
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
Researchers report multiple real-world email phishing campaigns that used tax and government-benefit themes to trick people into downloading malware. The campaigns used a “crypter” service called Cruciferra to hide malicious files and help malware run while avoiding detection. Targets included…
Multiple real-world intrusions used a ClickFix-style lure where victims visiting compromised websites saw fake CAPTCHA prompts and were tricked into running a command themselves. Separately, attackers also abused the legitimate, signed Node.js runtime (node.exe) to run malicious JavaScript while…
A state-sponsored campaign in South Korea used spear-phishing and hacked “trusted” local websites to infect visitors who had vulnerable AnySign4PC installed. In some cases, simply visiting a compromised page triggered the exploit and installed SIGNBT or COPPERHEDGE backdoors without any download…
