Chinese APT Exploits Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

A China-linked threat actor tracked as UTA0560 has been observed weaponizing a recently patched zero-day exploit chain dubbed "BlueMoon" to compromise multiple non-governmental organizations (NGOs) via targeted spear-phishing emails sent on September 1, 2026. According to Volexity researchers Ankur Saini, Conor Quigley, Sean Koessel, Steven Adair, and Tom Lancaster, the lure messages directed recipients to a U.S.-based university website vulnerable to a reflected cross-site scripting (XSS) flaw, which in turn redirected victims to attacker-controlled infrastructure hosting the multi-stage payload. Security teams can verify whether employee credentials have surfaced in past compromises using an email breach checker.

The exploit chain strings together three separate vulnerabilities: CVE-2026-85046 for arbitrary read/write within Chrome's V8 engine, CVE-2026-87491 to escape the browser sandbox, and CVE-2026-85880 to inject code through the Windows Advanced Local Procedure Call (ALPC) interface and achieve arbitrary code execution. UTA0560 filtered out non-Chrome-on-Windows visitors before serving the final page, which embedded three Base64-encoded JavaScript payloads: shellcode for host reconnaissance (p1), shellcode for Windows kernel privilege escalation (p2), and shellcode for browser process injection and next-stage download (pp). Analysts investigating the C2 domain ocr.opusaccel[.]top can run a WHOIS lookup to correlate infrastructure.

The follow-on payload, an executable named "msgbox.exe," initiates a DLL sideloading chain by extracting a legitimate Windows binary alongside a malicious "wsc.dll." That DLL contacts the same server to retrieve a hostname-tagged text file containing an MSI installer, whose custom actions launch an obfuscated JavaScript backdoor: GRIMWEDGE. Once active, GRIMWEDGE enters a persistent loop, polling its C2 server and executing returned instructions in memory via JavaScript's eval() command, giving operators capabilities spanning host reconnaissance, file and process management, command execution, and additional payload delivery. Because the campaign fingerprints browsers before exploitation, users can audit their own exposure with a browser fingerprint test to understand what data their client reveals to threat actors.