Chinese APT Deploys CLEANGULP via Chrome-Windows Zero-Day Exploit

Introduction

A significant cybersecurity incident has unfolded as security researchers confirm that a Chinese state-linked threat actor codenamed UTA0565 successfully weaponized a chain of zero-day vulnerabilities affecting both Google Chrome and Microsoft Windows. The attacks, which came to light following activity detected on September 3 and 4, 2026, targeted users through a set of carefully crafted spoofed websites designed to lure unsuspecting visitors into exploitation chains. This campaign marks a troubling escalation in the precision and technical sophistication of cyber-espionage operations attributed to Chinese-affiliated groups.

The threat actor chained two separate vulnerabilities in the Chrome browser—CVE-2026-85046 and CVE-2026-87491—alongside a critical flaw in Windows Advanced Local Procedure Call (ALPC) designated CVE-2026-85880. Together, these weaknesses formed a multi-layered escape and execution pathway that allowed the attacker to bypass browser sandbox protections, escalate privileges on the host system, and ultimately deploy a custom-built information-stealing payload known as CLEANGULP. The operation underscores how overlapping vulnerabilities across different software ecosystems can be combined to devastating effect.

Breaking Down the Zero-Day Chain

Zero-day exploits are among the most valuable commodities in the cybercrime and nation-state hacking landscapes. What makes this particular chain noteworthy is the way it bridges two entirely different operating environments—Chrome's sandboxed browser process and the deeper Windows kernel-level ALPC interface. By exploiting CVE-2026-85046 and CVE-2026-87491 inside Chrome, UTA0565 was able to achieve initial code execution within the browser's restricted environment. These two vulnerabilities likely involved type-confusion or use-after-free conditions common in Chromium's rendering and JavaScript engines.

From there, the attacker pivoted to CVE-2026-85880, a flaw in Windows ALPC that allowed privilege escalation beyond the sandbox boundary. ALPC is a core inter-process communication mechanism in Windows, and vulnerabilities in this area can grant attackers access to system-level operations. The chaining of these three flaws in sequence demonstrates a level of operational planning and vulnerability research that points to substantial resources and deep technical expertise.

• CVE-2026-85046: Chrome vulnerability enabling initial code execution within the browser process.
• CVE-2026-87491: Secondary Chrome flaw used to strengthen the exploitation path and bypass mitigation controls.
• CVE-2026-85880: Windows ALPC vulnerability used for sandbox escape and system-level privilege escalation.

Who Is UTA0565?

UTA0565 is a relatively recently identified threat actor that has drawn attention from cybersecurity analysts monitoring Chinese-affiliated operations. While the full scope of this group's activities is still being mapped, early intelligence suggests a focus on targeted espionage campaigns against organizations and individuals in sectors that may hold politically or economically sensitive information. The group's choice of infrastructure—fraudulent websites designed to mimic legitimate services—reflects a social engineering approach layered on top of highly technical exploitation methods.

What distinguishes UTA0565 from other Chinese APT groups is the streamlined nature of the attack chain. Rather than relying on complex multi-stage payloads or extensive dwell times, the operator appears to favor rapid compromise, efficient data exfiltration, and clean removal traces. This operational philosophy aligns with the deployment of CLEANGULP, a malware family whose name suggests an intentional emphasis on stealth and operational hygiene.

The CLEANGULP Malware Family

CLEANGULP is the payload delivered through this exploitation chain, and initial analysis suggests it is a modular information-stealing tool. While detailed technical specifications are still emerging, early reports indicate that the malware is capable of harvesting credentials, capturing browser session data, extracting documents, and potentially maintaining persistent access to compromised systems. The name itself—combining "clean" with a reference to a low-level Windows process—hints at a design philosophy centered on operating below the radar of conventional security tools.

Key characteristics believed to be associated with CLEANGULP include:

• Modular Architecture: The malware likely supports pluggable modules that can be updated or swapped post-compromise, allowing UTA0565 to adapt the payload to different target environments.
• Minimal Footprint: CLEANGULP appears to avoid unnecessary artifacts on disk, favoring in-memory operations where possible to reduce detection likelihood.
• Data Exfiltration Focus: The primary objective seems to be the extraction of valuable data rather than destructive activity, which is consistent with espionage-oriented operations.
• Anti-Analysis Techniques: The malware may incorporate checks for virtualized environments, debuggers, and security products commonly used by analysts and incident responders.

Defensive Recommendations and the Road Ahead

In the wake of this campaign, security teams worldwide should take immediate steps to harden their environments against similar threats. The following actions are strongly recommended:

• Patch Aggressively: Apply updates for Google Chrome and Microsoft Windows as soon as they become available. Given that these specific vulnerabilities have now been disclosed, attackers who were not part of the original campaign may begin incorporating them into broader exploitation efforts.
• Monitor ALPC Traffic: Implement logging and alerting around unusual ALPC calls, particularly those originating from browser processes or unfamiliar applications.
• Browser Isolation: Consider deploying browser isolation solutions that separate web content execution from the endpoint, reducing the blast radius of browser-based exploits.
• Threat Hunting: Proactively search for indicators of compromise associated with UTA0565 and CLEANGULP across network logs, endpoint telemetry, and identity systems.
• User Awareness: Train employees to recognize and avoid unfamiliar websites, especially those that mimic legitimate services or prompt unexpected software behavior.

The broader cybersecurity community is also watching closely to see whether Google and Microsoft issue formal advisories with additional technical details. Coordinated disclosure in cases like this is critical, as it allows defenders worldwide to update their detection rules and protective measures simultaneously.

Conclusion

The UTA0565 campaign serves as a stark reminder that the threat landscape is evolving at an unprecedented pace. State-sponsored actors are no longer content with single-vulnerability exploits; they are actively building sophisticated chains that span multiple platforms and software layers. The deployment of CLEANGULP through a Chrome-Windows zero-day combination demonstrates that even well-defended endpoints can fall victim to determined and highly skilled adversaries. For organizations seeking to stay ahead of such threats, adopting comprehensive AI-driven cybersecurity platforms that integrate real-time threat intelligence, behavioral analytics, and automated incident response is essential. Grivyonx Cloud offers a unified approach to cyber defense, combining advanced AI automation with deep cyber intelligence capabilities to detect, analyze, and neutralize sophisticated attack chains before they can inflict damage. As campaigns like this continue to emerge, the need for intelligent, adaptive security solutions has never been greater.