Chinese hackers are exploiting a Chrome-Windows zero-day chain through fake websites. The attacks target victims with carefully designed phishing pages. Researchers detected the activity on September 3 and 4, 2026. However, the campaign may have started before those dates. Attackers used three security flaws to escape browser protections and run malicious code. Therefore, the campaign creates a serious risk for users and organizations.
Three Flaws Power the Attack
The attack chain combines two Chrome vulnerabilities with one Windows flaw. The first Chrome flaw is tracked as CVE-2026-85046. The second Chrome flaw is known as CVE-2026-87491. Meanwhile, the Windows issue carries the identifier CVE-2026-85880. Together, these flaws can help attackers break out of Chrome’s security sandbox. As a result, attackers can execute code on targeted Windows devices.
Researchers linked the campaign to a threat actor known as UTA0565. The group used several fake identities during its attacks. For example, it posed as media groups and a non-government organization. It also created multiple fake websites instead of relying on one page. Therefore, victims could encounter different websites during the same campaign. This approach can make the attack harder to recognize and block.
Phishing Targets Government Groups
One campaign targeted government organizations in Asia. Attackers sent phishing emails written in Chinese and English. The messages asked recipients to support a Hong Kong activist. However, the emails falsely claimed to represent a policy organization. The messages included links to websites that copied legitimate news and policy pages. Therefore, recipients could mistake the pages for trusted sources.
The fake websites used hidden content to load the exploit chain. Specifically, a hidden iframe loaded an additional HTML file. That file used the three vulnerabilities to start the next attack stage. The exploit then downloaded an executable from a fake domain. Researchers identified the downloaded malware as CLEANGULP. As a result, the attackers could move from a browser visit to malware execution.
CLEANGULP Provides Remote Access
CLEANGULP gives attackers several ways to control infected computers. For example, it can run commands through a remote shell. It can also list active processes on the victim’s device. Furthermore, attackers can upload files to the infected computer. They can also download files from the device when needed. Therefore, the malware provides useful tools for further compromise.
The malware also supports beacon object files for additional actions. This feature can give attackers more flexibility after infection. However, researchers found another important detail in its network activity. CLEANGULP uses a fixed domain for command-and-control traffic. The domain closely resembles a legitimate media website. Therefore, the attackers appear to use familiar names to make their traffic less suspicious.
Fake Websites Support the Campaign
The attackers created several websites that copied legitimate organizations. These pages used similar names, layouts, and content to appear credible. Furthermore, the campaign used both Chinese and English materials. This approach allowed the attackers to target different groups with tailored messages. It also increased the chance that recipients would trust the links. Therefore, users should inspect web addresses before opening links from unexpected emails.
The use of multiple fake websites also shows careful campaign planning. Attackers can quickly replace one website when defenders block it. Meanwhile, new domains can support another round of phishing messages. This method can extend the life of an attack campaign. However, security teams can watch for newly created domains and suspicious page changes. They can also block known malicious infrastructure as new evidence appears.
Possible Coordinated Activity
Researchers believe the exploit kit may have spread among several threat groups. They noted similarities across attacks linked to Chinese cyber operations. However, researchers have not confirmed the full scope of the activity. The current findings come from observations by only two organizations. Therefore, the campaign may affect more victims than current reports show.
The shared tools could allow different attackers to customize the same attack chain. For example, one group could change the phishing theme while keeping the exploit code. Another group could modify the final malware for a different target. As a result, defenders may encounter similar attacks with different appearances. This pattern makes threat intelligence and continuous monitoring especially important.
How Organizations Can Reduce the Risk
Organizations should update Chrome and Windows as soon as security fixes become available. Furthermore, employees should avoid links from unexpected emails, even when the pages look familiar. Security teams should also use penetration testing to identify weaknesses in browsers, web applications, and exposed systems.
Regular testing can reveal attack paths before criminals discover them. Meanwhile, a Security Operations Center can monitor unusual browser activity, suspicious downloads, and unexpected command traffic. Therefore, combining proactive testing with continuous monitoring can help organizations detect attacks earlier and reduce the damage from zero-day exploitation.
