A China-linked threat actor has chained multiple software flaws to target non-governmental organizations. Security firm Volexity tracked the campaign under the name UTA0560. It observed the activity striking several NGOs on September 1, 2026. The attackers ultimately deployed a JavaScript backdoor called GRIMWEDGE.
The campaign began with carefully crafted spear-phishing emails. These messages encouraged recipients to click a seemingly legitimate link. Notably, the link pointed to a US-based university website. However, that website contained a cross-site scripting vulnerability.
The attackers abused that flaw to redirect victims silently. Victims then landed on threat-actor-controlled infrastructure hosting an exploit chain. Crucially, the system filtered out anyone not using Chrome on Windows. Consequently, only the intended targets triggered the full attack.
The exploit chain combined three separate security vulnerabilities. Two of the flaws affected Google Chrome directly. The third targeted a component within Microsoft Windows. Together, they let attackers break out of Chrome’s protective sandbox.
Once deployed, GRIMWEDGE granted attackers an initial foothold. It performs host reconnaissance and basic file management functions. Additionally, it enables command execution and further payload delivery. However, researchers noted it lacks built-in persistence or lateral movement.
Alarmingly, UTA0560 was not the only group involved. A second China-nexus actor used the identical exploit chain too. That group, known as APT31, deployed different final malware. Specifically, it installed a credential-stealing Chrome extension for surveillance.
That extension cleverly masqueraded as a Google Gemini add-on. It captured keystrokes, cookies, and session data continuously. Then it exfiltrated the stolen information to a remote server. This near-simultaneous use suggests the exploit was possibly shared.
The most important lesson involves a dangerous “patch gap.” The two Chrome fixes reached the open-source Chromium codebase first. However, they had not yet entered a stable Chrome release. Therefore, they effectively functioned as zero-days against actual Chrome users.
This gap gave attackers a valuable window to strike. Notably, Chrome recently shifted to a faster two-week release cycle. That change aims to shrink exactly this kind of exposure. For users, the takeaway remains simple: always update Chrome promptly.
