Chinese State Hackers Weaponize Chrome-Windows Zero-Day Chain for CLEANGULP Malware
A Chinese state-aligned threat group known as UTA0565 exploited a chain of three zero-day vulnerabilities in Google Chrome and Microsoft Windows to deploy new malware dubbed CLEANGULP. The attacks, detected on September 3 and 4, 2026, occurred before official patches were released, leveraging fake websites mimicking trusted organizations to deliver the payload. The exploit chain, named BlueMoon, combines two Chrome V8 engine flaws and one Windows privilege escalation bug to achieve remote code execution. Volexity researchers noted that this widespread adoption across multiple Chinese groups suggests a coordinated effort within the Chinese computer network exploitation community, with the core kit likely shared and customized by various actors.