Chinese espionage groups swarm to exploit triple-link chain of zero-days

Proofpoint identified a multi-stage zero-day exploit chain called BlueMoon—leveraging two Chromium V8 RCE flaws and a Windows ALPC privilege-escalation bug—that was actively used since late August by APT31 and at least three other China-aligned espionage groups to target organizations via phishing. Attackers delivered a malicious browser extension (masquerading as Google Gemini) to surveil browser activity, exfiltrate credentials and execute commands; exploits were used before public patches, and researchers warn the kit may proliferate to additional actors as patches roll out.