Known malicious kithighother
JungleBamboo — phishing and delivery infrastructure for the Chrome 0-day and the LONGTALE extension
family: junglebamboo-chrome-0day-2026-09
Short link:scanmalware.com/h/204
Infrastructure published by Volexity for JungleBamboo, a Chinese threat actor that delivered the Chrome zero-day CVE-2026-85046 in early September 2026 through phishing domains (msbenefit[.]com, gitprogram[.]com, m365update[.]com) and installed a malicious Chrome extension, LONGTALE, whose command-and-control ran on karlmalexander.workers[.]dev.
Anchors
SMQL queryrun
domain:m365update.com OR domain:msbenefit.com OR domain:gitprogram.com OR contacted_host:m365update.com OR contacted_host:*.m365update.com OR contacted_host:msbenefit.com OR contacted_host:*.msbenefit.com OR contacted_host:gitprogram.com OR contacted_host:*.gitprogram.com OR contacted_host:karlmalexander.workers.dev OR contacted_host:*.karlmalexander.workers.dev OR url:karlmalexander.workers.devProvenance
Added: 2026-09-23 15:26
Matches these domains and all their subdomains (for example proof.gitprogram[.]com, photos.msbenefit[.]com, and the extension download host xyz0102.gitprogram[.]com). workers.dev is a shared hosting platform, so only this one account, karlmalexander.workers[.]dev and its subdomains, is matched and never the platform itself. m365update[.]com was linked by registration pattern rather than observed in an attack.
References:
- https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/
- https://github.com/volexity/threat-intel/tree/main/2026/2026-09-09%20Chrome
- https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit
Sightings (0)
No sightings recorded yet.