A Chinese threat actor has been linked to a spear-phishing campaign targeting non-governmental organizations with a malicious JavaScript backdoor called GRIMWEDGE. The campaign, observed on September 1, 2026, exploited recently patched security flaws in Google Chrome and Microsoft Windows as part of a multi-stage attack chain.
Security researchers at Volexity are tracking the threat group as UTA0560. The attacks began with phishing emails designed to convince recipients to click on a link that appeared to lead to a legitimate U.S.-based university website. However, the website was vulnerable to a reflected cross-site scripting flaw, allowing the attackers to redirect victims to infrastructure under their control.
From there, the attackers used a three-stage exploit chain known as BlueMoon. The chain combined two Chrome vulnerabilities with a Windows flaw. CVE-2026-85046 was first used to obtain arbitrary read and write capabilities inside Chrome’s V8 sandbox. The attackers then used CVE-2026-87491 to escape the browser sandbox before exploiting CVE-2026-85880 in Windows Advanced Local Procedure Call to inject code into the Chrome process and achieve arbitrary code execution.
The attack was designed to target Windows systems running Chrome while filtering out other systems. The final exploit page contained three Base64-encoded binary payloads embedded inside JavaScript. One payload performed host reconnaissance and fingerprinting, another was responsible for Windows kernel privilege escalation, and the third handled browser process injection and downloading additional payloads.
For UTA0560, the next stage was an executable named msgbox.exe. The file acted as a loader, extracting a legitimate Windows binary and a malicious DLL called wsc.dll from itself. This started a DLL sideloading process that eventually contacted the attackers’ server and requested a text file named after the victim device’s hostname.
That file was actually an MSI installer containing an obfuscated JavaScript backdoor hidden inside its custom actions. Once executed, the malware established a command loop and repeatedly contacted its command-and-control server at ocr.opusaccel[.]top for instructions.
GRIMWEDGE can collect system information, list directories, create directories, delete files, enumerate running processes and terminate processes by their IDs. It can also read files up to 5 MB and execute commands through a hidden window. The backdoor includes file-upload functionality that allows attackers to send Base64-encoded data in chunks and eventually save the assembled file to the compromised computer.
Volexity said GRIMWEDGE does not contain built-in capabilities for persistence, lateral movement or broader data theft beyond its file-reading and upload functions. However, the researchers noted that it still gives UTA0560 an initial foothold that can be used to investigate compromised systems, collect interesting files and deploy additional tools through its command execution and file-upload features.
Volexity also observed another China-linked threat actor, JungleBamboo, also known as APT31, using the same Chrome and Windows exploit chain around the same time. In that campaign, the attackers deployed a loader called SUPERSTOMP, which was used to install a malicious Chrome extension known as LONGTALE or GemStone.
The extension was designed to look like a legitimate Google Gemini Chrome extension and used the ID ckiknalbeplpcpofpnabcnhjcegckfei. Once installed, it could capture keystrokes and web forms, steal cookies and browser sessions, take screenshots based on keywords supplied by the attackers, and collect browsing history, storage information and session data.
The stolen information was sent to the attackers’ command-and-control server roughly every 30 seconds. LONGTALE also supported remote command-and-control functions, although Volexity noted that it did not include a basic remote code execution capability for carrying out additional post-exploitation activity.
The researchers believe the simultaneous use of the same Chrome-Windows exploit chain by multiple China-linked groups could indicate that the exploit was sold or otherwise made available to several threat actors. Another possibility is that the groups obtained the techniques after reverse-engineering changes made to the Chromium source code.
The situation also highlights an unusual patch-gap problem. Google had already pushed fixes for the two Chrome vulnerabilities into the open-source Chromium project, but those changes had not yet reached a stable Google Chrome release. This created a window in which the vulnerabilities had technically been fixed upstream but remained exploitable against Chrome users.
The timing may have been particularly important because Google had been using a four-week cycle for major Chrome releases before recently moving to a two-week security release schedule. Attackers may have attempted to exploit the gap before the fixes reached stable Chrome versions and closed the window.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Volexity warned that these patch-gap vulnerabilities can create additional opportunities for attackers, particularly as increasingly capable large language models make vulnerability research and exploit development faster.
