Proofpoint (9 September 2026) documents BlueMoon, chaining CVE-2026-85046 (Chrome V8 type confusion), CVE-2026-87491 (V8 sandbox escape; patch-gap 0-day), and CVE-2026-85880 (Windows ALPC heap overflow LPE / AppContainer escape; Microsoft September Patch Tuesday + CISA KEV). First in-the-wild use attributed to China-aligned APT31 (Proofpoint: TA412, aka JungleBamboo / Violet Typhoon) from 28 August 2026; other espionage clusters rapidly reused the kit.

UPDATE 15 September 2026 desk (Volexity blog 9 Sep; THN wire 15 Sep): Volexity details two China-nexus clusters using the same byte-identical exploit chain against NGOs via spearphishing through reflected XSS on a legitimate US university site. UTA0560 deploys GRIMWEDGE (obfuscated JavaScript backdoor via MSI custom actions; C2 ocr.opusaccel[.]top). JungleBamboo/APT31 deploys SUPERSTOMP loader then LONGTALE (aka GemStone) credential-stealing Chrome extension.

UPDATE 23 September 2026 desk (Volexity Part 2 blog 21 Sep; THN wire 23 Sep): third China-nexus cluster UTA0565 used the same BlueMoon chain on 3–4 Sep 2026 via multiple fake websites (chinadigitaltimes[.]top; americanprgoress[.]top typosquat of Center for American Progress) with hidden iframe loading config.html; final payload chrome_cleanup.exe is previously undocumented CLEANGULP (MSVC; control-flow flattening). CLEANGULP installs to %LOCALAPPDATA%/Microsoft/IME/MicrosoftIME.exe with scheduled task “MicrosoftIME”; commands shell/ps/upload/download/bof; C2 thecovnresation[.]com over HTTP (AES-256-GCM + custom Base64 alphabet).

Targeting included Asian government entities (Hong Kong activist lure) and CAP-themed phishing. Distinct from desk cards cve-2026-85046 / cve-2026-87491 / ms-september-2026-patch-tuesday — this card is the shared kit and post-exploitation. Primary: Volexity Part 2; also Proofpoint; wire: THN 23 Sep 2026.