{"id":3097,"date":"2026-09-23T10:23:41","date_gmt":"2026-09-23T10:23:41","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3097"},"modified":"2026-09-23T10:23:41","modified_gmt":"2026-09-23T10:23:41","slug":"chinese-hackers-exploit-chrome-windows-zero-day-chain-to-deploy-cleangulp-malware","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3097","title":{"rendered":"Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 23, 2026<\/span><\/span>Zero-Day \/ Vulnerability<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A Chinese threat actor codenamed UTA0565<\/strong> has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites.<\/p>\n

The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break out of the browser’s sandbox and achieve remote code execution.<\/p>\n

\u00abUTA0565 masqueraded as various entities including media organizations and a non-governmental organization (NGO),\u00bb Volexity researchers Damien Cash and Tom Lancaster said<\/a> in an analysis published this week. \u00abNotably, this threat actor’s campaigns differed from previously documented attacks by using multiple fake websites to deceive victims.\u00bb<\/p>\n

One such campaign targeted Asian government entities with Chinese- and English-language phishing emails that urged recipients to support Hong Kong activist Chow Hang-tung<\/a> and masqueraded as the Center for American Progress (CAP). Chow was sentenced<\/a> to seven years and three months in prison earlier this month.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

These messages contained spoofed links pointing to \u00abchinadigitaltimes[.]top\u00bb and \u00abamericanprgoress[.]top,\u00bb which replicated the look of China Digital Times and CAP, while loading an additional HTML element via a hidden iframe.<\/p>\n

The HTML element (\u00abconfig.html\u00bb) is said to have used the same BlueMoon exploit kit combining CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880, with the final \u00abpp\u00bb shellcode downloading an executable named \u00abchrome_cleanup.exe\u00bb from the bogus domain. The payload is a malware family dubbed CLEANGULP, which is built using the Microsoft Visual C Compiler.<\/p>\n

It supports the following capabilities –<\/p>\n