Cybersecurity
Chinese hackers use Chrome-Windows chain to deploy CLEANGULP
Volexity said UTA0565 used fake websites and phishing emails to chain Chrome and Windows flaws in early September 2026, then delivered CLEANGULP through a BlueMoon exploit kit.
- Volexity said the activity was carried out by a Chinese threat actor it tracks as UTA0565.
- The attacks were detected on 3 and 4 September 2026 and chained CVE-2026-85046, CVE-2026-87491 and CVE-2026-85880.
- One campaign used Chinese- and English-language phishing emails that urged support for Chow Hang-tung and impersonated the Center for American Progress.
- The exploit chain dropped an executable called chrome_cleanup.exe, which delivered the CLEANGULP malware family.
- Volexity said CLEANGULP supported shell commands, process listing, file upload, file download and BOF execution, and used a domain resembling theconversation.com for command-and-control over HTTP.
Volexity said UTA0565 used fake websites to exploit Chrome and Windows on 3 and 4 September 2026. The chain linked CVE-2026-85046, CVE-2026-87491 and CVE-2026-85880 to break out of the browser sandbox and run code.
In one campaign, the emails were written in Chinese and English and asked recipients to support Chow Hang-tung. They pretended to come from the Center for American Progress and pointed to pages made to look like China Digital Times and CAP, with a hidden iframe loading the next stage.
Volexity said the chain dropped chrome_cleanup.exe, which carried the CLEANGULP malware family. The malware was built with Microsoft Visual C Compiler and included commands for a shell, process listing, file upload, file download and BOF execution.
The researchers also said CLEANGULP used a hard-coded domain resembling theconversation.com for command-and-control over HTTP. They said the activity seen so far came from only two organisations’ observations and could be broader, and that the core kit was likely shared and adapted by multiple groups.
Named in this story
People
- Damien Cash
- A Volexity researcher who co-authored the analysis
- Tom Lancaster
- A Volexity researcher who co-authored the analysis
- Chow Hang-tung
- The activist named in the phishing lure
Organisations
- UTA0565
- The codenamed threat actor said to have used the exploit chain
- Volexity
- The security firm whose researchers published the analysis
- Center for American Progress (CAP)
- The organisation impersonated in phishing emails
- China Digital Times
- The site copied by one of the spoofed web pages
- The Conversation
- The media outlet whose name was mimicked in the command-and-control domain
Products and systems
- Google Chrome
- The browser whose vulnerabilities were chained in the attacks
- Microsoft Windows
- The platform that included the vulnerability used to escape the browser sandbox
- Windows Advanced Local Procedure Call
- The Windows component affected by the exploit chain
- BlueMoon
- The exploit kit used to load the payload
- CLEANGULP
- The malware family delivered by the campaign
How the source tells it
A largely neutral technical report, with no strong emotive framing beyond the source’s own security terminology.
No emotive framing was found in the original.