Chinese espionage groups swarm to exploit triple-link chain of zero-days

Proofpoint observed four state-aligned groups, including APT31 (Violet Typhoon), exploiting a three‑bug zero-day chain dubbed "BlueMoon" in late August–early September to compromise Chromium-based browsers and Windows via phishing campaigns that install a malicious browser extension for surveillance, credential theft and remote commands; the chain combined two V8 RCE vulnerabilities and a Windows ALPC privilege escalation, was used before public patches, targeted a limited set of organizations (under 20 observed) across sectors, and may proliferate as weaponized exploit kits spread.