A Chinese cyberespionage group, codenamed UTA0565, is exploiting a highly sophisticated exploit chain that combines zero-day vulnerabilities in Google Chrome and Microsoft Windows. The attacks were based on fake websites and deceptive emails, with the ultimate goal of breaking out of the browser sandbox and executing malicious code on the victim's system.
The activity was recorded on September 3 and 4, 2026 , according to Volexity 's analysis , and shows that attackers are investing in multi-layered attacks where social engineering is combined with techniques for exploiting unknown or newly disclosed vulnerabilities.
Three vulnerabilities in one attack chain
This particular campaign exploited three vulnerabilities: CVE-2026-85046 and CVE-2026-87491 in Chrome and CVE-2026-85880 in Windows Advanced Local Procedure Call (ALPC).
The value of such a chain lies precisely in the combination of individual weaknesses. A vulnerability in the browser may give an attacker the ability to launch an attack, but Chrome's sandbox is designed to limit access to the rest of the operating system. To overcome this obstacle, an additional exploit is required that can lead to sandbox escape and subsequent code execution.
UTA0565 appears to have had an exploit kit called BlueMoon, which automated these specific stages.
See also: BlueMoon: New exploit kit hits Chrome and Windows with zero-day chain
Fake websites that looked like real media and organizations
Of particular interest is the way the group approached its victims. According to Volexity, it did not use a single fake website, but a network of pages that imitated different organizations.
In one of the campaigns, government agencies in Asia received phishing emails in Chinese and Englishthat appeared to come from the Center for American Progress. The emails urged recipients to support activist Chow Hang-tung.
The links led to domains designed to resemble the real China Digital Times and Center for American Progress. The similarity was not limited to the name, as the pages could load additional HTML content via a hidden iframe.
This is a classic technique where social engineering acts as the first step before technical exploitation takes action.
The hidden iframe was activating the exploit kit
Behind the scenes, the config.html element was reportedly triggering the BlueMoon exploit kit. The combination of the three vulnerabilities allowed attackers to bypass Chrome's security restrictions and gain operating system-level access.
The shellcode named "pp" then downloaded an executable file from the fake website that appeared as chrome_cleanup.exe.
The filename is typical of a technique that seeks to create the impression that it is a legitimate browser add-on. To a user who sees only the filename, its actual function may not be obvious.
CLEANGULP turns access into full control
The final payload belongs to the malware family CLEANGULP, which is built with Microsoft Visual C. Its capabilities indicate that the attack did not stop at the initial infiltration.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The malware supports functions for executing commands via shell, recording active processes, uploading and downloading files, and executing Beacon Object Files (BOF).
See also: Chrome V8 Zero-Day: Code execution inside the sandbox
In other words, after successfully exploiting zero-days, attackers could obtain a flexible tool for further exploration and manipulation of the system. This significantly increases the potential value of an initial infection, especially when the victim has access to sensitive corporate or government data.
Even C2 imitates a real site
Another notable feature is the mechanism for communicating with the command-and-control server. CLEANGULP uses a built-in domain, thecovnresation[.]com, for HTTP communication.
The name appears to be a variation of the real theconversation[.]com, a non-profit media outlet. This choice suggests that the deception is not limited to the initial phishing, but may continue to the level of the infrastructure used by the malware.
Possible common tool ecosystem
Volexity believes that the use of the same exploit kit by different actors may indicate broader collaboration or tool sharing in the Chinese Computer Network Exploitation (CNE).
This is particularly important, as an exploit kit originally created for one group can be modified and exploited by other actors, significantly increasing the number of possible attacks.
At the same time, researchers warn that the incidents recorded so far come from just two organizations, so the true scope of activity may be greater.
See also: Hackers infect Windows devices with Winos4.0 framework
Why this attack is important
Case UTA0565 highlights a critical shift in the way modern targeted attacks are carried out. An attacker does not need to rely solely on a malicious file or suspicious link. They can create an entire digital path of deception, from convincing phishing and fake websites to browser exploitation and malware installation.
For organizations and businesses, this means that protection must cover multiple layers. Chrome and Windows updates are essential, but equally important is educating users to recognize suspicious links, spoofed domains, and messages that create a sense of urgency.
This campaign is yet another indication that zero-days in popular browsers can become much more powerful when combined with operating system vulnerabilities. For defenders, the challenge is no longer just to detect an exploit, but to identify the entire attack chain before the attacker moves from the browser to the system itself.
