Fake news sites hid a Chrome and Windows zero-day chain

Volexity has published a second report on a Chrome and Windows exploit chain that was being used as zero-days against Asian government targets, this time attributing the work to a third Chinese group it tracks as UTA0565. The campaigns ran on 3 and 4 September 2026, while the flaws were still unpatched, and ended with a malware family the company has named CLEANGULP.

What the three flaws were

The chain combined two Chrome bugs, CVE-2026-85046, a type confusion flaw in the V8 engine, and CVE-2026-87491, with CVE-2026-85880, a heap-based buffer overflow in the Windows Advanced Local Procedure Call interface that lets an attacker with a foothold raise their privileges. Chrome shipped a fix for CVE-2026-85046 in version 152.0.7977.82, and the National Vulnerability Database scores it 8.8, high. Chained together, the three gave the attackers a route out of the browser sandbox and into code execution on the machine.

The fake sites behind the phishing

The lure was a phishing email, written in Chinese and sent to Asian government bodies, that asked readers to support the imprisoned Hong Kong activist Chow Hang-tung. Another round posed as the Center for American Progress. Both carried links to domains dressed up as the organisations they imitated: chinadigitaltimes[.]top standing in for China Digital Times, and americanprgoress[.]top, a typosquat of americanprogress.org with a pair of letters transposed, standing in for the think tank. The second site loaded much of its content from the genuine website and slid in a hidden iframe, a zero-height element that pulled down the same exploit kit Volexity described in its first report.

The payload: CLEANGULP

That iframe's config.html downloaded chrome_cleanup.exe, an 893 KB Windows executable, from the fake think-tank domain. Volexity calls the malware CLEANGULP. It installs itself as MicrosoftIME.exe inside the user's local application data, hides behind a scheduled task carrying the same Microsoft name, and accepts a fixed set of commands: run a shell command, list running processes, upload, download, or run a beacon object file. Traffic goes to a single hardcoded address, thecovnresation[.]com, which is theconversation.com with two letters swapped, over plain HTTP, with message bodies encrypted using AES-256-GCM and a custom base64 alphabet. The executable is obfuscated with control flow flattening to slow analysis down.

One kit, several groups

Volexity pivoted on the registration pattern behind those domains and found six more registered between 2 and 4 September, imitating a media organisation, halal restaurant search sites and corporate training providers, which it assesses with medium confidence belong to the same actor. More telling is who else was holding the kit. Volexity's earlier report covered two other Chinese groups, and Proofpoint has since identified further users, which points to an exploit framework shared and customised across a national cyber-espionage community rather than the work of one team. Both companies say the true scale is probably wider than what has been documented.

Our opinion

The decoy work is the part worth studying. Pulling live content from a real think tank into a copycat domain costs almost nothing, and it defeats the habit most people have of deciding whether a link is trustworthy by whether the page looks right. The malware's naming runs the same trick in miniature: MicrosoftIME.exe behind a scheduled task called MicrosoftIME is built to survive a glance at Task Manager. It also changes what attribution is worth. When a single exploit kit is shared and customised across a national espionage scene, naming the group behind a campaign tells defenders far less about what arrives next than it once did, and installing the patch is no longer the end of the job.