Google is rolling out anti-spam updates, an exploit kit targets Chromium browsers by combining two critical vulnerabilities, and malware is now using AI models to drive their post-compromise actions. Here are the technical signals of the week that deserve close attention.
Blue Moon Kit: the Chromium-Windows attack chain to watch
The Blue Moon exploit kit combines two Chromium vulnerabilities with a Windows privilege escalation. One of the vulnerabilities, related to the V8 engine, allows for remote code execution. Google confirmed that it was being exploited in the wild as of September 3, 2026.
Microsoft patched the vulnerability in Edge on September 2, but the entry vector remains classic: a phishing email. The payload leads to credential theft and the installation of spyware.
This type of multi-vector chain is not new, but the rapid deployment of the kit in active campaigns necessitates checking that the Chromium browsers in your environment are up to date. We observe that teams following web news on Geek Newz were able to react in the first hours thanks to regular monitoring of security bulletins.
The key takeaway: the combination of browser vulnerability + OS privilege escalation remains the dominant attack pattern this quarter. Browser-side patches are not sufficient if Windows updates do not follow.
AI-driven malware: CLOSEDQUORUM queries Gemini, DeepSeek, and Mistral
The Windows malware CLOSEDQUORUM marks a turning point in the offensive use of language models. This malware queries multiple AI providers to automatically choose its post-compromise actions: stealing browser passwords, retrieving Windows credentials, exfiltrating cryptocurrency wallet data.
The models used include Google Gemini, DeepSeek, Qwen, and Mistral. The malware does not rely on a single provider: it switches from one model to another based on the availability and relevance of the responses obtained.
We recommend no longer limiting defensive strategies to blocking domains. Researchers who analyzed CLOSEDQUORUM advocate for behavioral detection of suspicious actions rather than just network filtering.
- Monitor outgoing API calls to AI model endpoints from unauthorized processes
- Detect attempts to access browser password vaults by unknown executables
- Log requests to multiple AI providers in rapid succession, an atypical behavior for legitimate use
September 2026 Spam Update: fourth anti-spam update from Google this year
Google launched the September 2026 Spam Update on September 24. This is the fourth anti-spam update of the year, just over a month after the previous one.
This accelerated pace confirms that Google is intensifying pressure on AI-generated content with no added value. Sites that publish large-scale content without editorial oversight are the primary targets.
Meanwhile, the Search Console now distinguishes searches initiated from a smartphone camera or a screenshot from traditional text queries. This segmentation alters the interpretation of performance data for sites generating traffic via visual search.
What this changes for SEO tracking
Performance reports in the Search Console must be filtered by search type to remain actionable. Mixing text search and visual search in the same analysis skews click-through rates and average positions. Visual queries exhibit radically different click behaviors compared to text queries.
AI security in the enterprise: extortion and internal audit under pressure
Google warns of extortion campaigns specifically targeting high-value AI training data. Attackers are no longer just encrypting files: they identify and exfiltrate proprietary datasets before negotiating.
On the governance side, the debate over auditing AI models is intensifying. Independent external evaluators like METR and Redwood Research are stepping in to test model security, but the question of the actual scope of these audits remains open.
The tension between deployment speed and the robustness of safeguards has never been more visible. Companies storing proprietary AI datasets are becoming prime targets for extortion groups.
Return of Lycos: a weak signal to note
ADN Contents is betting on nostalgia by relaunching the Lycos portal, more than fifteen years after the closure of Lycos Europe. The gamble relies on the emotional memory of French internet users who experienced the web of the 2000s.
This initiative reflects a search for alternatives to the closed ecosystems of American giants. Its real impact will depend on its ability to capture regular usage beyond the announcement effect. The market for browsers and web portals remains a difficult oligopoly to penetrate, even with a nostalgic positioning.
