On September 9, 2026, Proofpoint described BlueMoon, an exploit kit used by four espionage-motivated groups between 28 August and 3 September. It chains two Chrome V8 flaws with a Windows kernel privilege-escalation flaw, but the latter affected only selected older builds. Proofpoint’s observations describe targeted campaigns, not widespread compromise of all Chrome users.
What the research establishes
Proofpoint observed four distinct clusters reusing the kit: TA412 targeted US NGOs, mining companies and physical commodity traders; UNK_LateNight targeted US aerospace firms; UNK_DoubleCheck targeted a Vietnamese manufacturing entity; and UNK_QuietRacket targeted organizations in Singapore and Indonesia. Campaigns began with phishing emails leading to an attacker-controlled page. Proofpoint notes that some group identities and details about several payloads remain uncertain.
The chain uses three vulnerabilities: CVE-2026-85046 (V8 type confusion), CVE-2026-87491 (V8 sandbox escape), and CVE-2026-85880 (Windows ALPC privilege escalation). The first two provide a browser foothold; the third could then elevate privileges on selected older Windows builds. Proofpoint says Google and Microsoft have patched all three flaws.
Why patch timing matters
The Chrome vulnerabilities had already been fixed in public Chromium source code before patches reached the affected stable releases; this interval is known as a “patch gap.” Proofpoint’s clues pointing to AI-assisted development are not conclusive evidence; the researchers describe this as a hypothesis. The clear lesson is to reduce the time between a patch becoming available and its deployment, especially for flaws being exploited.
Check Chrome and Windows
Inventory Chrome, Edge and other Chromium browsers alongside Windows versions. Deploy the current security updates offered by Google, Microsoft and the browser vendor, then verify installed versions and required restarts. Do not assume patching Chrome alone addresses the Windows stage, or vice versa. Versions cited in September 2026 advisories are historical references, not a recommendation to remain on those builds.
Respond to a suspicious page
If a device opened a suspected BlueMoon link, do not infer compromise from the click alone; isolate it if suspicious activity appears, preserve logs and have it assessed. For the TA412 campaign, Proofpoint documented a malicious Chrome extension installed after exploitation; updating does not remove artifacts already present. After confirmation and cleanup, revoke exposed sessions and replace secrets from a clean device. Our infostealer guide explains first steps after possible browser-data theft; our analysis of malicious Chrome and Edge extensions covers a separate session-theft case.
How Soclyde fits
Soclyde does not replace Chrome/Windows patching or EDR. It can help identify accounts and keys used from a suspicious device, then replace them with unique secrets in a local-first encrypted vault.
Key takeaway
BlueMoon shows how quickly multiple groups can reuse an exploit kit. Update the browser and Windows, then investigate separately for malware; a patch does not clean a device already compromised. To prepare replacement of credentials confirmed as exposed, read our secure password generator guide or create a secret with the Soclyde generator. You can also contact Soclyde to organize team access.
