🔴 Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits

A third Chinese threat actor has been linked to phishing campaigns that cloned trusted websites and chained Chrome and Windows zero-day exploits to deploy a previously undocumented backdoor.

The activity occurred on September 3 and 4, 2026, while the targeted vulnerabilities remained unpatched in Google Chrome.

It followed Volexity’s September 9 disclosure that UTA0560 and JungleBamboo, also known as APT31 or Violet Typhoon, had used the exploit chain in separate operations.