Proofpoint says at least four China-linked espionage groups fired the same BlueMoon code at different victims during the four weeks a Chromium fix took to reach stable Chrome, and two more groups probably did too.
Perspective Coverage
9 publishers
- Builder
- Builder 31%
- Operator
- Operator 60%
- Investor
- Investor 9%
Reality
- Evidence80
- Adoption30
- Hype gap+10
- Incentives40
- Confidence76
Volexity attributes September 1 spear-phishing at multiple NGOs to the Chinese cluster UTA0560. The chain used two Chrome flaws and one in Windows ALPC, and a second China-nexus actor ran the same chain.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence62
Microsoft rates a missing authentication check in Azure AI Foundry at CVSS 10.0
CVE-2026-85889 let an unauthorized attacker elevate privileges over the network in the platform enterprises use to run generative AI agents. Microsoft says the fix is already live and there is nothing for customers to install.
Reality
- Evidence58
- Adoption45
- Hype gap+18
- Incentives72
- Confidence55
KREMLIN installers forge Chrome's Secure Preferences HMACs to register a stealer extension
Elastic Security Labs says the Brazilian crew it calls REF9334 has been running this since at least May 2025, writing its extension into Chromium's Secure Preferences and reading C2 addresses out of an Ethereum smart contract.
Reality
- Evidence62
- Adoption42
- Hype gap+12
- Incentives55
- Confidence58
Espionage crews exploited a Chrome flaw that Chromium had already fixed in public source
Proofpoint says a shared toolkit called BlueMoon chained two V8 flaws that Chromium had fixed in public but Chrome had not yet shipped, plus a Windows kernel bug that elevates only on older builds.
Reality
- Evidence62
- Adoption58
- Hype gap+18
- Incentives66
- Confidence58
Four espionage crews picked up the same Chrome and Windows exploit chain within days
Proofpoint says two of the three bugs in the BlueMoon chain were fixed in public Chromium source before they reached stable Chrome. Defenders could close one link: an old Windows build.
Publishers:proofpoint.com
Reality
- Evidence62
- Adoption50
- Hype gap+12
- Incentives66
- Confidence58