Hackers Clone Legitimate Websites to Silently Trigger Chrome and Windows Zero-Day Exploits

Hackers are using convincing copies of trusted websites to turn an ordinary browser visit into a full Windows compromise.

The campaign pairs targeted phishing emails with a chained set of previously unknown flaws in Google Chrome and Microsoft Windows, giving attackers a quiet path from a fake page to malware on a victim’s device.

The activity was recorded on September 3 and 4, before the affected flaws were patched. It targeted Asian government entities with a Chinese-language message about jailed Hong Kong activist Chow Hang-tung, while another lure impersonated the Center for American Progress.

The apparent goal was not mass disruption, but carefully selected access for espionage. Analysts at Volexity identified the activity as the work of a third China-linked actor they track as UTA0565.

Volexity said in a report shared with Cyber Security News (CSN) that the group used the same core exploit kit previously tied to other actors, but refined the presentation and payload delivery for its own operations.

The finding shows why polished phishing pages remain dangerous even for alert users. A page can display genuine material pulled from the real organization it imitates, leaving few obvious visual warnings.

Readers can review CSN’s Chrome zero-day vulnerability update for the wider patching context behind the browser flaw used in this campaign.

Hackers Clone Legitimate Websites

Each phishing message pointed to a domain controlled by the attackers that closely copied a legitimate site. One fraudulent page mirrored China Digital Times, and another copied most content from the Center for American Progress website.

On the latter, a hidden iframe loaded an extra page in the background, so the malicious code could run without changing what the visitor saw.

That hidden component chained Chrome flaws CVE-2026-85046 and CVE-2026-87491 with the Windows privilege-escalation flaw CVE-2026-85880.

In simple terms, the first stages broke out of browser restrictions and the final stage gave the attackers higher rights on Windows. The related BlueMoon exploit chain report explains how this class of attack can move from a browser renderer to deeper system access.

UTA0565 kept much of the existing framework but swapped in a new final payload and altered supporting code. The chain downloaded a replacement executable, stripped its Windows internet warning marker, and launched it through Windows shell components.

Changes to variable names, debugging text, and logging options suggest an effort to tailor a shared toolkit while making analysis and detection harder.

CLEANGULP Expands Post-Compromise Access

The downloaded program belongs to a previously undocumented malware family called CLEANGULP. It is heavily disguised to frustrate investigation, then installs itself under a Microsoft-looking name and creates a scheduled task for persistence.

Once active, it can run commands, list processes, upload or download files, and execute additional code supplied by its operators. CLEANGULP communicates over ordinary HTTP with a hardcoded command server, encrypting its messages before sending them.

That design can help its traffic blend into routine web activity, while the use of typo-squatted domains gives the operation a familiar appearance at both the initial phishing and later control stages.

Administrators should hunt the indicators below, review proxy and DNS logs, and isolate any affected systems for full investigation. The campaign also underlines the need to apply browser and Windows security updates quickly, especially after active exploitation is reported.

Organizations should test and deploy the relevant updates, block the listed infrastructure, and warn staff to verify unexpected advocacy or policy-themed emails through an independent channel.

CSN’s September Patch Tuesday update covers the Windows fix for CVE-2026-85880 and the urgency of remedial action. Security teams should check whether browser update policies leave unmanaged devices behind, because an unpatched workstation can provide a foothold into a larger network.

Email gateways should flag newly registered lookalike domains, while incident responders should search endpoints for listed host artifacts and suspicious outbound connections.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Hackers Clone Legitimate Websites to Silently Trigger Chrome and Windows Zero-Day Exploits appeared first on Cyber Security News.