Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

Severity

High

Researchers from Volexity have identified a Chinese threat actor tracked as UTA0565 exploiting a Google Chrome and Microsoft Windows zero-day exploit chain through fake websites to deploy a previously undocumented malware family known as CLEANGULP.

The activity was detected on September 3 and 4, 2026, targeting Asian government entities. The threat actor used Chinese- and English-language phishing emails that directed victims to fake websites impersonating legitimate organizations, including China Digital Times and the Center for American Progress (CAP).

The attack chained three vulnerabilities:

CVE-2026-85046 – Google Chrome vulnerability
CVE-2026-87491 – Google Chrome sandbox escape vulnerability
CVE-2026-85880 – Microsoft Windows Advanced Local Procedure Call vulnerability

The combined exploit chain allowed the attacker to execute code through Chrome, escape the browser’s security sandbox, and ultimately achieve remote code execution on the affected Windows system.

The final payload, CLEANGULP, provides attackers with capabilities for command execution, process enumeration, file upload and download, and execution of Beacon Object Files (BOFs), allowing further post-compromise activity.

How?

The attack began with targeted phishing emails sent to Asian government entities. The emails contained links leading to attacker-controlled websites designed to closely imitate legitimate organizations.

Two identified spoofed domains were:

chinadigitaltimes[.]top
americanprgoress[.]top

The websites replicated the appearance and content of legitimate websites to make the phishing activity appear legitimate. In the CAP impersonation campaign, a hidden iframe loaded an additional HTML resource named config.html without obvious changes to the visible webpage.

The hidden resource loaded the BlueMoon exploit kit, which chained the three Chrome and Windows vulnerabilities.

The exploit chain used:

CVE-2026-85046 → CVE-2026-87491 → CVE-2026-85880

The exploit allowed the attacker to break out of Chrome’s sandbox and execute code with higher privileges on the Windows system.

Following successful exploitation, the shellcode downloaded an executable named chrome_cleanup.exe from the attacker-

controlled infrastructure:

hxxps://americanprgoress[.]top/chrome_cleanup.exe

The downloaded executable was identified as CLEANGULP, a previously undocumented malware family compiled using the Microsoft Visual C Compiler. The malware was heavily obfuscated using techniques including control-flow flattening and indirect calls to make analysis more difficult.

CLEANGULP provides several capabilities, including:

shell – execute commands on the compromised system
ps – enumerate running processes
upload – upload files from the compromised system
download – download additional files
bof – execute Beacon Object Files for additional functionality

CLEANGULP also uses a hard-coded command-and-control domain:

thecovnresation[.]com

The domain appears to imitate the legitimate The Conversation media organization’s domain through typosquatting. The malware communicates with the C2 server over HTTP.

The use of fake websites, browser zero-days, sandbox escape, and a custom malware payload allows the threat actor to move from a phishing link to system compromise without requiring the victim to manually execute a downloaded file.

Conclusion

The UTA0565 campaign demonstrates how threat actors can combine phishing, fake websites, browser zero-day vulnerabilities, Windows exploitation, and custom malware to compromise targeted systems.

By exploiting Chrome and Windows vulnerabilities through a hidden iframe, the attackers were able to move from a malicious webpage to code execution while bypassing the browser’s sandbox. The subsequent deployment of CLEANGULP provided capabilities for command execution, process discovery, file transfer, and further code execution.

The campaign also highlights the importance of monitoring Chrome and Windows exploitation activity, suspicious browser child processes, newly registered or typosquatted domains, unusual outbound HTTP connections, and execution of unexpected binaries from user directories.

Organizations should ensure Chrome and Windows security updates are deployed promptly, monitor for the identified IoCs, block known malicious infrastructure, and investigate systems that accessed the identified spoofed domains.

Security teams should also hunt for chrome_cleanup.exe, CLEANGULP-related hashes, suspicious scheduled tasks or user-local executables, and connections to thecovnresation[.]com.

Source

https://thehackernews.com/2026/09/chinese-hackers-exploit-chrome-windows.html