On day 18, Volexity said a third Chinese actor, UTA0565, joined the campaign using the same Google Chrome CVE-2026-85046 and CVE-2026-87491 flaws and the Microsoft Windows CVE-2026-85880 flaw, but delivered them through multiple fake websites and phishing emails. The vulnerabilities were still unpatched when UTA0565 used them on September 3-4.
The lure works by sending victims to a spoofed site that looks like a real news or advocacy page, then quietly loading hidden content inside the page. That hidden load triggers the exploit chain, so the attack can land without the victim doing anything more than opening the link.
The shift matters because takedowns aimed at one domain no longer meaningfully end the campaign. If an organization leans on URL filtering or single-site removal, the exposure now sits in a distributed lure set: one fake site can go dark while another keeps the same chain alive.
CVSS 8.8 HIGH: type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Microsoft patch: Release Notes.
CISA federal remediation date Sep 18 · date passed
InfraTrust report warns network management systems under attack
Attackers are increasingly targeting the management systems used to control enterprise infrastructure, with several critical vulnerabilities actively exploited before or shortly after vendors disclosed them.