China-Linked Hackers Target NGOs with Chrome and Windows Exploits

• •Chinese threat actors UTA0560 and JungleBamboo exploited Chrome and Windows vulnerabilities.
• •The attack targeted NGOs using spear-phishing emails leading to a compromised university site.
• •Three CVEs were exploited, enabling the deployment of the GRIMWEDGE backdoor.

On September 1, 2026, Chinese threat actors UTA0560 and JungleBamboo executed phishing campaigns targeting NGOs, exploiting zero-day vulnerabilities in Google Chrome and Microsoft Windows. The attack utilized a spear-phishing email that redirected victims to a compromised U.S.-based university website, leveraging a reflected XSS vulnerability. The exploit chain involved three CVEs: CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880, allowing attackers to gain arbitrary code execution and install the GRIMWEDGE backdoor. This malware facilitates host reconnaissance and command execution, polling a command-and-control server for further instructions. Volexity documented these operations, highlighting the use of sophisticated multi-stage exploits. The attacks were confirmed to be in progress, with active exploitation reported.