A reflected XSS on a US university site launched a three-CVE Chrome chain at NGOs

The link in the phishing mail pointed at a legitimate university domain. "The emails contained a message encouraging the users to click a link that led to the website of a U.S.-based university," Volexity researchers Ankur Saini, Conor Quigley, Sean Koessel, Steven Adair and Tom Lancaster said. "These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain." ^[3] The report describes the site only as U.S.-based.

The exploit page then filtered visitors, serving only systems running Chrome on Windows ^[8]. Replaying one of those URLs from Firefox, or from a Linux analysis box, returns nothing useful.

The three flaws run in sequence. CVE-2026-85046 gives arbitrary read/write inside the V8 sandbox ^[5]. CVE-2026-87491 escapes the browser sandbox ^[6]. CVE-2026-85880, in Windows Advanced Local Procedure Call, injects code into the Chrome browser process for arbitrary code execution ^[7]. Because each step depends on the one before it, a fix for any single link stops the chain at that step ^[18]. Proofpoint documented the chain, which Volexity calls BlueMoon, before this campaign ^[4].

After execution, the page decodes three Base64 shellcode blobs from its own JavaScript: p1 for host reconnaissance, p2 for kernel privilege escalation, pp for browser process injection and payload download ^[9]. The loader that follows, msgbox.exe, extracts a legitimate Windows binary and a malicious wsc.dll and sideloads it; the DLL then requests a text file named after the hostname collected during profiling ^[10]. That text file is an MSI, and its custom actions execute the obfuscated JavaScript backdoor ^[11]. GRIMWEDGE polls ocr.opusaccel[.]top and runs what it gets back in memory through eval() ^[12].

It is a thin implant on purpose. "The code has no built-in persistence, lateral movement, or exfiltration mechanism beyond the file-read and upload commands," the researchers said ^[13]. What it does support is Type, which reads a file up to 5 MB, Run, which executes a command in a hidden window, and a chunked Upload that reassembles a file from the C2 in memory before writing it to disk ^[15]. The researchers said the foothold is "sufficient enough for UTA0560 to survey the host, retrieve files of interest, and deploy additional tooling via the Run and Upload commands" ^[14].

Volexity also saw JungleBamboo, also tracked as APT31, using the same chain around the same time to drop a loader called SUPERSTOMP, which pulls down LONGTALE, a credential-stealing Chrome extension also known as GemStone ^[16]. LONGTALE poses as a Google Gemini extension under ID ckiknalbeplpcpofpnabcnhjcegckfei and does keylogging and form capture, cookie and session theft, keyword-triggered screenshots, and bulk exfiltration of keystrokes, cookies, storage, history and session metadata ^[17]. So an inventory sweep for msgbox.exe and wsc.dll covers the UTA0560 branch alone ^[19].

Volexity describes the flaws as recently patched and the chain as zero-day at the time of use, without dating the fixes ^[20]. For the NGOs hit on September 1, then, there was no patch to have applied ^[2]. All three bugs are fixed, so patch state decides who is reachable from here. Who was compromised that day is a separate question, and it has to be answered with retrospective hunting on browser process and DNS telemetry.