Chinese Hackers Deploy CLEANGULP Malware Through Chrome Zero-Day Chain

The cybersecurity landscape in late 2026 has been jolted by the discovery of a sophisticated Chrome-Windows zero-day exploit chain used by Chinese threat actors to deploy a previously undocumented malware family dubbed CLEANGULP. The attacks, detected in early September 2026, demonstrate how state-sponsored groups are chaining multiple zero-day vulnerabilities to bypass browser sandboxes and achieve full remote code execution on targeted systems.

The Exploit Chain: Three Zero-Days, One Objective

Security researchers at Volexity identified the threat actor codenamed UTA0565 exploiting a chain of three vulnerabilities to break out of Google Chrome’s sandbox and execute arbitrary code on Windows machines. The exploit chain consists of:

• CVE-2026-85046 — A Chrome vulnerability that serves as the initial entry point
• CVE-2026-87491 — A second Chrome flaw used to escalate privileges within the browser
• CVE-2026-85880 — A Windows Advanced Local Procedure Call vulnerability that enables sandbox escape and remote code execution

This combination, referred to as the BlueMoon exploit kit, represents a troubling trend in which threat actors chain together multiple zero-day vulnerabilities across different software platforms to maximize damage. Rather than relying on a single flaw, attackers weave together exploits for the browser and the operating system, creating a path that traditional security controls struggle to block.

How the Attacks Unfolded

According to Volexity researchers Damien Cash and Tom Lancaster, UTA0565 masqueraded as various entities including media organizations and a non-governmental organization (NGO). The threat actor created multiple fake websites to deceive victims, a departure from previously documented attack patterns associated with this group.

One campaign specifically targeted Asian government entities with Chinese- and English-language phishing emails. The messages urged recipients to support Hong Kong activist Chow Hang-tung and impersonated the Center for American Progress (CAP), a well-known Washington-based policy institute. Chow was sentenced to seven years and three months in prison earlier in September 2026, making the social engineering lure particularly timely and emotionally compelling.

The phishing emails contained spoofed links pointing to domains such as chinadigitaltimes[.]top and americanprgoress[.]top — deliberate typosquats of China Digital Times and CAP respectively. These fake sites replicated the appearance of the legitimate organizations while silently loading an additional HTML element via a hidden iframe. This element, called config.html, initiated the BlueMoon exploit chain, ultimately downloading a payload disguised as chrome_cleanup.exe.

CLEANGULP: Capabilities and Command Infrastructure

The final payload, CLEANGULP, is a malware family compiled using the Microsoft Visual C Compiler. Once installed on a victim’s machine, it provides attackers with a versatile toolkit for remote access and data exfiltration. The malware supports five primary commands:

• shell — Execute arbitrary system commands
• ps — List all running processes on the infected machine
• upload — Upload files from the victim’s system to the attacker’s server
• download — Download additional payloads or tools onto the victim’s machine
• bof — Execute Beacon Object Files, enabling in-memory execution of additional code without touching disk

One particularly noteworthy aspect of CLEANGULP is its command-and-control infrastructure. The malware communicates over HTTP using a hard-coded domain thecovnresation[.]com, a typosquat of theconversation.com, a legitimate non-profit media outlet known for publishing academic research and commentary. By mimicking a trusted educational domain, the attackers reduce the likelihood that network security tools will flag the traffic as suspicious.

A Coordinated Effort Across Multiple Threat Actors

Volexity’s analysis suggests that the BlueMoon exploit kit is not exclusive to UTA0565. The researchers noted that the widespread adoption across multiple threat actors suggests a coordinated effort within the Chinese cyber exploitation community, where the core kit was likely shared, customized, and weaponized by multiple groups. This sharing of zero-day exploit infrastructure represents a significant escalation, as it multiplies the number of actors capable of launching these sophisticated attacks.

The researchers warned that the activity reported so far reflects only two organizations’ observations, and the full scope and impact are likely far broader. This implies that many more victims may exist beyond what has been publicly documented.

The Broader 2026 Malware Landscape

The CLEANGULP campaign arrives amid a broader transformation in the malware ecosystem. According to WatchGuard Technologies’ Global Threat Report for the first half of 2026, threat actors are leveraging AI-assisted tooling to shift from high-volume campaigns to precision attacks targeting specific victims. The report revealed several striking statistics:

• Network attack volume dropped by 79%, yet novel malware increased by more than 2,000% year-over-year on endpoints
• Nearly 96% of endpoint threats appeared on exactly one machine, indicating highly targeted payloads
• 95% of malware arrived over TLS-encrypted channels, but only 20% of deployed devices inspect encrypted traffic
• 41 new ransomware groups emerged in the first half of 2026 alone

WatchGuard CISO Corey Nachreiner noted that attackers are not less dangerous because alert totals declined. They are using every tool at their disposal to become more selective and precise. The shift from reusable payloads and high-volume scanning to malware tailored for individual systems makes detection significantly harder for traditional security tools.

Defensive Recommendations

Organizations facing this evolving threat landscape should adopt a multi-layered defense strategy:

• Patch aggressively — The CLEANGULP campaign exploited three zero-days, but many attacks still rely on vulnerabilities disclosed years ago. The WatchGuard report found the median vulnerability referenced by top network-attack signatures was disclosed in 2014.
• Enable TLS inspection — With 95% of malware arriving over encrypted channels, failing to inspect TLS traffic means blind spots in your perimeter. Only 20% of organizations currently do this.
• Implement zero-trust architecture — The shift toward credential-based access and native tool abuse means perimeter defenses alone are no longer sufficient. Strong identity controls and continuous verification are essential.
• Deploy AI-powered detection — As attackers use AI to generate unique payloads, defenders need AI-driven tools capable of identifying novel threats based on behavior rather than signatures alone.
• Train employees on phishing recognition — The CLEANGULP campaign relied on social engineering using timely political topics. Regular awareness training helps employees recognize and report suspicious communications.
• Monitor for typosquat domains — Both the phishing sites and the CLEANGULP C2 domain relied on slight misspellings of legitimate domains. DNS monitoring and domain reputation services can help detect these.

Looking Ahead

The CLEANGULP malware campaign illustrates the increasing sophistication of state-sponsored cyber operations in 2026. The ability to chain multiple zero-day vulnerabilities, impersonate legitimate organizations, and deploy custom malware with versatile capabilities represents a significant threat to government entities, enterprises, and critical infrastructure alike.

What makes this campaign particularly alarming is the shared nature of the exploit kit. When zero-day chains are distributed among multiple threat actors, the window for defensive action shrinks dramatically. Organizations can no longer assume that a single patch will neutralize a threat — they must assume that multiple groups are probing their defenses simultaneously with different variations of the same toolkit.

The convergence of AI-powered malware generation, precision targeting, and shared exploit infrastructure means that the cybersecurity community must evolve its defensive posture just as quickly as attackers are advancing their offensive capabilities. Collaboration between threat intelligence providers, timely patching, and investment in behavioral detection technologies will be critical in staying ahead of campaigns like CLEANGULP in the months and years ahead.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous