The latest disclosure involving UTA0565, a China-linked threat actor tracked by Volexity, highlights how quickly sophisticated exploit chains can spread across multiple espionage operations.

According to Volexity, UTA0565 exploited a chain of three vulnerabilities affecting Google Chrome and Microsoft Windows on September 3 and 4, 2026, while the vulnerabilities were still unpatched in the affected products.

The chain consists of:

  • CVE-2026-85046, a Chrome V8 vulnerability;
  • CVE-2026-87491, another Chrome V8 vulnerability used to escape the browser sandbox; and
  • CVE-2026-85880, a Windows ALPC vulnerability used to move beyond the browser and achieve code execution on the host.

Together, these vulnerabilities transformed a visit to a malicious website into a path from browser compromise to execution on the underlying Windows system.

The campaign relied on convincing fake websites

What distinguishes UTA0565 from some of the previously observed users of the same exploit framework is its use of carefully constructed fake websites.

Volexity observed UTA0565 impersonating several types of legitimate organizations, including media outlets and a non-governmental organization.

One campaign targeted Asian government entities with Chinese- and English-language phishing emails encouraging recipients to support Hong Kong activist Chow Hang-tung.

The lure impersonated the Center for American Progress and directed victims toward an attacker-controlled lookalike domain.

Another campaign used a fake version of China Digital Times.

These were not simply crude pages containing an exploit.

The attacker attempted to make the sites appear credible by reproducing or incorporating content resembling the legitimate organizations being impersonated.

That is important because sophisticated targeted phishing increasingly relies on contextual authenticity rather than obvious deception.

If the victim sees the news articles, branding and subject matter they expect, the malicious site may not immediately appear suspicious.

The browser is only the first stage

The exploit chain demonstrates why browser vulnerabilities can become particularly dangerous when combined with operating-system flaws.

A Chrome vulnerability by itself may initially provide execution inside the browser's restricted environment.

Modern browsers deliberately isolate web content inside sandboxes to prevent a compromised page from freely interacting with the rest of the operating system.

UTA0565's chain was designed specifically to cross those security boundaries.

The attack first abused the Chrome V8 vulnerabilities, then used the Windows ALPC flaw to escape the remaining restrictions and reach the Windows host.

This is a classic example of exploit chaining:

browser vulnerability → sandbox escape → operating-system exploitation → malware execution

Individually, each vulnerability represents a security weakness.

Combined, they create a much more powerful attack path.

The final payload is a newly documented malware family called CLEANGULP

After successful exploitation, the attack downloaded a payload called:

chrome_cleanup.exe

Volexity identified this executable as belonging to a previously undocumented malware family it named CLEANGULP.

The malware is written in C and was compiled using Microsoft Visual C.

It also employs significant obfuscation techniques, including control-flow flattening and indirect function calls, making static analysis more difficult.

The malware installs itself as:

%LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe

and creates a scheduled task named:

MicrosoftIME

to maintain persistence.

The naming is particularly deliberate.

Microsoft IME is a legitimate Windows component associated with input methods and language support. Using a path and task name that resemble legitimate Microsoft functionality may help malicious activity blend into an environment where defenders are reviewing processes or scheduled tasks.

CLEANGULP provides a useful remote-control capability

Volexity's analysis found that CLEANGULP supports several commands, including:

  • executing shell commands;
  • listing running processes;
  • uploading files;
  • downloading files; and
  • executing Beacon Object Files.

The ability to execute Beacon Object Files is especially noteworthy because it can provide attackers with a modular post-exploitation framework.

Instead of embedding every capability into the original malware, attackers can potentially load additional functionality as required.

This can reduce the initial malware footprint while allowing the operation to evolve after compromise.

Command-and-control traffic also uses deception

The analyzed CLEANGULP sample communicates with:

thecovnresation[.]com

The domain is a typosquat of the legitimate news organization:

theconversation[.]com

This demonstrates how domain impersonation can continue beyond initial phishing.

The attacker used lookalike domains not only to deceive victims into visiting malicious websites, but also to make post-compromise command-and-control infrastructure appear less suspicious.

An analyst reviewing connections at speed might interpret a domain resembling a legitimate news site as ordinary browsing activity.

That is precisely why defenders should examine exact domain spelling rather than relying on visual familiarity.

The C2 communication is encrypted

Volexity observed CLEANGULP communicating with its command-and-control infrastructure over HTTP while encrypting the actual request and response data using AES-256-GCM.

The encrypted data is subsequently Base64 encoded using a custom alphabet.

This creates an important detection lesson.

Network defenders cannot assume that plain HTTP means plain-text malicious traffic.

Attackers can create their own encryption layer inside otherwise ordinary HTTP requests.

Inspection therefore needs to consider metadata and behavior such as:

  • unusual destination domains;
  • periodic beaconing;
  • repeated POST requests;
  • uncommon URL paths;
  • process-to-network relationships; and
  • newly registered or visually deceptive domains.

The wider concern is that UTA0565 was not the only actor with this exploit chain

Perhaps the most significant finding is the apparent reuse of the same Chrome-Windows exploit framework by several different threat clusters.

Earlier reporting linked the same underlying exploit kit, called BlueMoon, to APT31 and several other espionage-focused clusters.

Proofpoint observed multiple groups using the chain within days, including China-aligned actors targeting NGOs, aerospace organizations, government entities, financial organizations and manufacturing targets.

Volexity subsequently identified UTA0565 as another user of the framework.

This is unusual and important.

High-quality browser exploit chains are technically difficult and potentially valuable.

Seeing several threat actors deploy substantially the same chain within such a short period suggests that the exploit framework may have been shared, distributed or otherwise made available across multiple operations.

Volexity assesses that this pattern may indicate coordination or sharing within the Chinese computer-network-exploitation ecosystem.

That is an assessment, not proof that every actor is controlled by the same organization.

But operationally, the conclusion for defenders is similar: once an exploit framework becomes available to multiple capable threat actors, the number of potential campaigns can increase very quickly.

The patch-gap issue deserves particular attention

The vulnerabilities also demonstrate the danger of what researchers describe as a patch gap.

In this case, fixes for Chrome-related vulnerabilities had appeared in the upstream Chromium code before corresponding fixes reached stable Chrome releases.

That creates an awkward security window.

Attackers can potentially study upstream code changes, determine what security problem was fixed, develop an exploit, and target users who still have no stable product update available.

This turns a technically fixed upstream issue into an effective zero-day against downstream users.

Earlier analysis of the BlueMoon exploit chain specifically highlighted this problem.

The lesson extends beyond Chrome.

Any organization relying on open-source components should understand that public security-related code changes can unintentionally reveal vulnerabilities before downstream products have deployed the corresponding fixes.

Organizations should patch both Chrome and Windows

All three vulnerabilities have now been addressed.

Organizations should verify that managed endpoints have received the relevant Chrome and Windows security updates rather than assuming automatic updating completed successfully.

This is particularly important for:

  • government environments;
  • NGOs;
  • research organizations;
  • financial institutions;
  • aerospace organizations;
  • organizations operating in Asia; and
  • individuals likely to be targets of strategic intelligence collection.

However, patching should be accompanied by historical threat hunting because exploitation occurred before the fixes were widely available.

What should defenders hunt for?

Organizations should investigate systems for indicators associated with both the exploit infrastructure and CLEANGULP.

Particular attention should be paid to:

%LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe

and scheduled tasks named:

MicrosoftIME

Security teams should also look for unusual connections to domains resembling legitimate media organizations, particularly recently registered typo-squatted domains.

Volexity identified several suspicious domains associated with UTA0565 activity, including impersonations of The Conversation and other media, restaurant-search and corporate-training sites.

Defenders should not rely solely on published domains and hashes.

Attackers can replace infrastructure almost immediately after disclosure.

Behavioral detection should look for:

Chrome exploitation → unexpected process execution → executable written beneath LocalAppData → scheduled-task creation → outbound beaconing to recently registered domains.

Browser patching is now an enterprise security priority

Browsers have become one of the most exposed applications in modern enterprises.

Employees routinely use them to access:

  • email;
  • SaaS platforms;
  • identity systems;
  • financial applications;
  • cloud consoles; and
  • internal services.

They also continuously process untrusted content from the Internet.

That makes browser vulnerabilities exceptionally valuable to attackers.

Organizations should therefore treat browser patching with urgency comparable to operating-system patching.

Waiting several weeks to deploy a critical browser update may provide adversaries with exactly the exploitation window they need.

High-risk users may require stronger browser isolation

Organizations with employees who are likely espionage targets should consider additional defensive controls beyond ordinary patching.

These may include:

  • browser isolation;
  • restricted browsing environments;
  • application control;
  • enhanced endpoint monitoring;
  • stronger URL inspection;
  • DNS monitoring;
  • attachment and link sandboxing; and
  • dedicated systems for sensitive administrative activities.

Senior government officials, policy researchers, journalists, defence personnel and other high-value users frequently receive highly tailored lures.

The question is not necessarily whether they can recognize every malicious page.

The more sustainable approach is to reduce what a successful browser exploit can achieve.

The campaign demonstrates the value of layered exploitation

One of the clearest lessons from this incident is why defenders cannot evaluate vulnerabilities entirely in isolation.

CVE-2026-85046, CVE-2026-87491 and CVE-2026-85880 each address a particular security boundary.

Attackers combined them to systematically remove those boundaries.

A browser sandbox assumes the operating system remains trustworthy.

An operating-system privilege boundary assumes the attack has not already gained arbitrary execution inside a privileged application context.

Exploit chains succeed by attacking those assumptions sequentially.

This is why seemingly separate vulnerabilities can become substantially more dangerous when used together.

The broader cybersecurity lesson

The UTA0565 campaign brings together several trends that defenders should pay attention to:

zero-day exploitation + exploit sharing + browser-to-OS chaining + realistic phishing sites + typo-squatted infrastructure + custom malware + encrypted command-and-control.

None of these techniques is entirely new.

What matters is how effectively they have been combined into a coherent espionage operation.

The attack also demonstrates that sophisticated threat actors are investing heavily in making the victim's browsing experience appear normal.

The malicious page does not necessarily need to display a suspicious download button or obvious warning message.

If exploitation succeeds silently, simply visiting the page may be sufficient.

That fundamentally changes the value of traditional advice such as “do not download unknown files.”

There may be nothing for the user to download manually.

The strongest lesson from the UTA0565 campaign is therefore that browser and operating-system security must be treated as one defensive boundary, not two separate patching problems.

When attackers possess an exploit chain capable of crossing both, a single visit to a convincing fake website can become the starting point for persistent compromise.

A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break

Source: Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware via The Hacker News — published 23 Sep 2026.