A reflected XSS on a US university site launched a three-CVE Chrome chain at NGOs

Volexity attributes a spear-phishing campaign exploiting recently patched Google Chrome and Microsoft Windows flaws to a Chinese threat cluster it tracks as UTA0560, delivering a JavaScript backdoor called GRIMWEDGE.

Volexity said the UTA0560 activity targeted multiple non-governmental organizations on September 1, 2026.

Volexity researchers Ankur Saini, Conor Quigley, Sean Koessel, Steven Adair and Tom Lancaster said: "The emails contained a message encouraging the users to click a link that led to the website of a U.S.-based university. These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain."

The threat actor filtered out systems not using Chrome on Windows when they visited the URL.

The final exploit page embeds three binary payloads as Base64-encoded strings within JavaScript: p1, shellcode that reflectively loads a DLL for host reconnaissance and fingerprinting; p2, shellcode that reflectively loads a DLL for Windows kernel privilege escalation; and pp, shellcode for browser process injection and payload download.

For UTA0560 the next-stage payload is an executable named msgbox.exe, a loader that extracts from itself a legitimate Windows binary and a malicious DLL (wsc.dll) to start a DLL sideloading chain; the DLL contacts the same server to fetch a text file named after the device hostname obtained during profiling.

The fetched text file is an MSI installer designed to execute an obfuscated JavaScript backdoor contained within the MSI custom actions.

Once launched, GRIMWEDGE enters a persistent command loop polling a command-and-control server at ocr.opusaccel[.]top and executes instructions in memory via eval().

The Volexity researchers said: "The code has no built-in persistence, lateral movement, or exfiltration mechanism beyond the file-read and upload commands."

The Volexity researchers said the backdoor provides an initial foothold on a compromised host "sufficient enough for UTA0560 to survey the host, retrieve files of interest, and deploy additional tooling via the Run and Upload commands."

GRIMWEDGE parses commands including Info, Dir, Mkdir, Del, Tasklist, Taskkill, Type (read a file up to 5 MB), Run (execute a command within a hidden window), Upload (chunk), which appends a Base64-encoded chunk from the C2 to an in-memory buffer, and Upload (commit), which saves the buffer to disk.

Volexity said it also observed a second China-nexus threat actor known as JungleBamboo (aka APT31) using the same exploit chain around the same time to deploy a loader named SUPERSTOMP, which installs LONGTALE, a credential-stealing Chrome extension also referred to as GemStone, from a remote server.

LONGTALE masquerades as a Google Gemini Chrome extension (ID: ckiknalbeplpcpofpnabcnhjcegckfei) to evade detection and supports keylogging and form capture, cookie and session theft, screenshot capture triggered by C2-supplied page keywords, and bulk exfiltration of keystrokes, cookies, storage data, navigation history and session metadata.

Volexity's account describes the Chrome and Windows flaws as recently patched and calls the exploit chain a zero-day chain at the time of use, and does not state when the three fixes shipped.

The three exploits run in a fixed order, so a fix for any one of CVE-2026-85046, CVE-2026-87491 or CVE-2026-85880 halts the chain at that step.

The chain then escapes the browser sandbox via CVE-2026-87491.

The same three-CVE chain delivered two unrelated payload sets, UTA0560's msgbox.exe and GRIMWEDGE and JungleBamboo's SUPERSTOMP and LONGTALE, so host indicators from one campaign do not detect the other.