China Hackers Exploit Chrome-Windows Zero-Day Chain

Chinese threat actor UTA0560, tracked by Volexity, launched a spear-phishing campaign on September 1, 2026, targeting multiple NGOs. The attack exploited a chain of three vulnerabilities in Google Chrome and Microsoft Windows to deploy a JavaScript backdoor called GRIMWEDGE. The campaign used a reflected XSS flaw on a U.S. university website to redirect victims to exploit infrastructure.