Security researchers from Proofpoint identified a new exploit kit named BlueMoon, which combines three distinct vulnerabilities to deploy malware. The kit targets two flaws within the Chromium V8 engine and one vulnerability in the Windows kernel. Affected systems include Windows 10, Windows 22, and the initial release of Windows 11.
The exploit chain leverages a patch gap in the Chromium supply chain, allowing attackers to weaponize vulnerabilities before stable browser updates are released. Proofpoint noted that the use of AI likely accelerated the development of these exploits. The vulnerabilities are identified as CVE-2026-85046 and CVE-2026-85880, while the sandbox escape lacks a specific CVE designation.
Four distinct threat actor groups were observed using BlueMoon, with the first campaign initiated by TA412 on August 28. Subsequent attacks occurred throughout early September. While all three vulnerabilities have received patches within the last 24 hours, experts warn that the kit may continue to see use by various threat actors due to its low barrier to entry.
The rapid development and distribution of the BlueMoon kit suggest a shift in how high-value exploit chains are created. By reverse engineering publicly accessible upstream patches in open source codebases, attackers can quickly deploy exploits against downstream consumers. Proofpoint expects the kit to remain relevant for both espionage and financially motivated groups.
