A Russian-aligned threat actor tracked by Proofpoint as TA488, also known as Void Blizzard or Laundry Bear, has been exploiting a Microsoft Exchange Outlook Web Access vulnerability to gain persistent mailbox access.
The campaign abuses CVE-2026-42897, a cross-site scripting flaw in Outlook Web Access on on-premises Microsoft Exchange Server. Proofpoint says the activity began on July 22, 2026, and targeted organizations in the United States and Europe, including government, telecommunications, finance, hospitality, and aerospace sectors.
What makes this campaign especially serious is that the malware can survive normal recovery steps. Password resets, browser restarts, and even re-imaging the victim’s device may not remove the attacker’s access if server-side mailbox permissions and tokens are not cleaned up.
The Vulnerability: CVE-2026-42897
CVE-2026-42897 is an improper input neutralization issue in Microsoft Exchange Server that allows cross-site scripting in Outlook Web Access. NVD lists Microsoft’s CVSS score as 8.1 High, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on May 15, 2026.
The flaw affects on-premises Exchange Server environments, including Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition, according to the affected software entries listed by NVD.
Microsoft disclosed the issue in May and later released Exchange Server security updates that addressed it. Search results from Microsoft’s Exchange Team also note that Exchange Online was not impacted and that the July 2026 update removed the earlier recommendation to keep the mitigation in place after patching.
“Half-Click” Exploitation
Proofpoint describes the campaign as a half-click exploit.
The victim does not need to download an attachment or click a link. Opening the malicious email in Outlook Web Access can be enough to trigger the exploit, because the OWA server mishandles HTML in the message body and allows attacker-controlled JavaScript to run in the browser context.
The lures were intentionally boring. Proofpoint observed generic subjects related to supply chains, gas markets, tourism indicators, public health, hydrology, and energy. The goal appears to be simple: get the target to open and briefly skim the message, then dismiss it as junk without reporting it.
That is what makes the attack dangerous. There are no obvious malicious attachments or suspicious URLs for the user to notice.
OWAReaper: A Browser-Based Implant for Outlook Web Access
The infection chain delivers a previously undocumented JavaScript implant that Proofpoint calls OWAReaper.
OWAReaper runs inside the Outlook Web Access reading pane. It does not need to place a traditional executable on the victim’s machine, which makes endpoint-based detection harder. Proofpoint described it as the most sophisticated backdoor it has observed being delivered through this kind of half-click exploit.
Once running, OWAReaper gathers mailbox-related information such as the user’s email address, username, and Outlook settings. It also attempts to harvest saved OWA credentials by creating invisible input fields and waiting for the browser’s autofill behavior to populate them.
The implant also rewrites the original email on the Exchange server to remove the exploit content, helping reduce visible evidence after execution.
Why Credential Rotation Does Not Remove Access
The most important part of the campaign is persistence.
OWAReaper can use Outlook add-ins with ReadWriteMailbox permissions to obtain OAuth tokens through Exchange Web Services. It then uses Exchange APIs to grant Owner-level permissions to the built-in Default user on every mail folder.
That creates a server-side access problem.
If the attacker has access to another authenticated account in the same organization, they may continue accessing the victim’s mailbox through those folder permissions, even after the victim’s password is reset.
This is why normal remediation is not enough.
Changing the password may stop direct access as the victim, but it does not automatically remove malicious folder permissions or revoke stolen tokens.
Persistence in Browser Storage
OWAReaper also stores an encrypted copy of itself in the browser’s localStorage under a legitimate OWA settings key.
Because OWA later evaluates that stored state as part of its normal sync restore process, the implant can run again when the user opens OWA in the browser.
The malware also adds a hidden iframe to messages stored in OWA’s offline IndexedDB cache. That means poisoned cached messages can help re-trigger infection when opened later, creating another layer of persistence.
This combination of server-side permission abuse and browser-side storage makes the attack more resilient than ordinary credential theft.
Command and Control
OWAReaper uses multiple command-and-control paths.
Proofpoint says the implant can retrieve commands through public GitHub commit search or through attacker-sent emails delivered into the mailbox. It also supports multiple exfiltration methods, including encrypted HTTPS and DNS tunneling as a fallback.
This gives the operator flexibility. If one channel is blocked or detected, another can still be used.
For defenders, that means remediation must include network monitoring, mailbox inspection, token review, and local browser artifact cleanup.
Link to Earlier Zimbra Activity
Proofpoint says OWAReaper appears to be an evolution of ZimReaper, malware previously used by the same actor against Zimbra webmail. The attribution to TA488 is based on behavioral overlap, shared focus on email and credential theft, encoded DNS exfiltration, and the continued use of half-click webmail exploits.
The campaign also suggests growing capability. Proofpoint noted that the earliest infrastructure tied to the campaign was created in March 2026, about two months before Microsoft’s out-of-band disclosure and mitigation activity for CVE-2026-42897. Proofpoint said this makes it feasible that TA488 used the vulnerability as a zero-day.
What Defenders Should Do
Organizations running on-premises Exchange with OWA should treat this as an urgent incident-response priority, not only a patching task.
Key actions include:
- apply the relevant Exchange Server security updates
- confirm CVE-2026-42897 mitigation or patch status
- audit Exchange folder permissions
- remove unexpected Default user permissions
- revoke and audit EWS tokens for affected add-ins
- review Outlook add-ins with ReadWriteMailbox permissions
- clear OWA IndexedDB cache on affected endpoints
- clear suspicious OWA localStorage keys
- hunt for OWAReaper indicators and C2 activity
- monitor for DNS tunneling and unusual HTTPS exfiltration
- review mailboxes that showed activity after password rotation
Proofpoint specifically recommends revoking and auditing EWS tokens for affected add-ins, auditing and removing Exchange folder permission grants to the Default user, clearing OWA’s IndexedDB and the relevant localStorage key, and blocking or alerting on known command-and-control infrastructure.
Why This Matters
This campaign shows why email compromise is no longer only about stolen passwords.
Attackers are abusing the webmail application itself, browser storage, OAuth tokens, add-in permissions, and Exchange folder permissions to build persistence that survives traditional cleanup.
For defenders, the lesson is clear: when OWA is exploited, password rotation is only the beginning.
The mailbox, tokens, add-ins, browser artifacts, and server-side folder permissions all need to be reviewed.
Final Thoughts
TA488’s OWAReaper campaign is a major escalation in webmail-focused intrusion tradecraft.
The attack requires very little user interaction, runs inside the OWA browser context, leaves a limited host footprint, and can preserve mailbox access even after credentials are changed.
That makes it especially dangerous for government, telecom, finance, hospitality, aerospace, and other high-value sectors still running on-premises Exchange OWA.
Patch Exchange, but do not stop there. Hunt for persistence, remove malicious folder permissions, revoke tokens, clean browser storage, and treat continued mailbox access after credential rotation as a serious compromise signal.
