// GeminiHIGH
Multiple espionage groups, primarily China-linked including APT31, deployed the BlueMoon exploit kit starting August 28, 2026, targeting NGOs, mining, and commodity trading firms in the US and Southeast Asia. The kit chains two Chrome V8 zero-days (CVE-2026-85046 and an unassigned sandbox escape) with Windows ALPC flaw CVE-2026-85880 to achieve remote code execution. APT31 specifically delivered a malicious Chrome extension disguised as Google Gemini called GemStone, which functions as a browser-based credential thief and surveillance backdoor.
- Four Spy Groups Used the Same Chrome and Windows Exploit Kit Wit(opens in a new tab)
- Novel Blue Moon kit targeting Chrome and Windows reflects new re(opens in a new tab)
- China-Linked Hackers Exploit Chrome and Windows Zero-Days in Blu(opens in a new tab)
- BLUEMOON: Multi-Actor Exploitation of the Chromium Patch Gap(opens in a new tab)
- China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to De(opens in a new tab)
// Get alerts for Gemini