Chinese Hackers Weaponize Chrome-Windows Zero-Day Chain to Deliver CLEANGULP Malware

Chinese threat actor UTA0565 deployed a zero-day exploit chain on September 3 and 4, 2026, targeting Google Chrome and Microsoft Windows to achieve remote code execution. The attackers used the BlueMoon exploit kit to chain Chrome vulnerabilities CVE-2026-85046 and CVE-2026-87491 with Windows Advanced Local Procedure Call flaw CVE-2026-85880, breaking completely out of the browser's sandbox. Asian government entities were targeted with phishing emails masquerading as the Center for American Progress, directing victims to spoofed media and NGO domains. A hidden iframe on the fake sites executed the exploit chain and downloaded an executable named "chrome_cleanup.exe," installing the CLEANGULP malware built with Microsoft Visual C Compiler. The CLEANGULP payload establishes HTTP command-and-control communication through a hard-coded domain intentionally mimicking the non-profit media outlet The Conversation. "This seemingly widespread adoption across multiple threat actors suggests a coordinated effort within the Chinese CNE community, where the core kit was likely shared, customized, and weaponized by multiple groups." — Volexity.