Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation

The Russian threat actors recently linked to the exploitation of a now-patched vulnerability in Zimbra have been observed exploiting another vulnerability, this time in Microsoft Outlook Web Access (OWA), to target U.S. and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors.

The activity, which began on July 22, 2026, involves the weaponization of CVE-2026-42897 (CVSS score: 8.1), a cross-site scripting (XSS) vulnerability in OWA. It was flagged by Microsoft as having been exploited in attacks as far back as May 2026.

Enterprise security company Proofpoint has attributed the activity to Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard), which was recently attributed to the zero-day exploitation of CVE-2025-66376, an XSS flaw in Zimbra's Classic UI, since at least July 2025 before it was patched four months later.

In these attacks, the threat actors sent out messages from adversary-controlled Proton Mail accounts and from previously compromised addresses that triggered an exploit for CVE-2025-66376 as soon as the emails were viewed via a vulnerable version of Zimbra, ultimately resulting in the deployment of a JavaScript payload dubbed ZimReaper that's capable of harvesting 90 days of the victim's mail and other valuable data.

"TA488 is doubling down on the use of 'half-click' exploits - where opening the email is enough to trigger compromise - with significantly improved loading mechanisms, techniques, and malware, signaling an improvement in the group's tradecraft and capability," Proofpoint researchers Greg Lesnewich, Stuart Del Caliz, Nick Attfield, Konstantin Klinger, Saher Naumaan, and Mark Kelly said.

Like before, the activity relies on compromised accounts to send emails exploiting the flaw. The volume of the phishing messages and breadth of targeting is a departure from prior TA488 campaigns and is assessed to be an intentionally broad effort to blend in with mass-mailing spam and fly under the radar.

The emails themselves feature vague message lures with no action required on the part of the recipient. The messages have been found to mimic informational emails on topics such as supply chain analyses, research updates, and metrics for tourism or gas markets.

The use of such generic emails is once again a consistent hallmark in the threat actor's half-click exploit chains, as the idea here is to lend them an illusion of legitimacy and not arouse a victim's suspicion by purposefully excluding any URLs or attachments. In doing so, the likelihood that a recipient opens and reads the message increases, effectively firing the exploit for CVE-2026-42897 in the process.

"This allows a loader piece of JavaScript to use the onload= event handler to parse the rest of the message body, assemble a Base64 fragment, and execute it as encoded JavaScript," Proofpoint explained. "The initial exploit trigger and relevant payload blobs are stored in the social media icons shown in the message body HTML. The next-stage payload data is stored after # symbols, which the browser stops at when parsing images from Base64."

The new wave of exploitation revolving around CVE-2026-42897 culminates with the deployment of a previously unknown JavaScript browser-based implant codenamed OWAReaper that's specifically built for persistent access within Microsoft's webmail client.

Described as the most sophisticated backdoor delivered via half-click exploits, the malware is an evolution of ZimReaper, while sharing significant source code and behavioral overlaps. It's executed within the OWA reading pane. Once executed, it uses Outlook APIs to rewrite the email on the Exchange server and remove the exploit content.

In tandem, the malware takes steps to disable OWA pop-ups and the ability to right-click during its run. It also creates a session key that's unique to the target, before proceeding to gather the target's email address, username, and Outlook settings. It then creates two invisible input elements in the web page's Document Object Model (DOM) so as to capture the victim's OWA saved credentials via the browser's autofill feature.

The next step entails writing an encrypted version of itself and a decryption wrapper into the browser's localStorage. This, in turn, causes the malware to be automatically executed every time an unsuspecting user opens an OWA tab in the browser.

OWAReaper checks for installed Outlook add-ins with ReadWriteMailbox permissions, and, if found, uses them to steal OAuth tokens, and grants itself Owner-level permissions to the Default user on every mail folder. This process grants complete mailbox access to any authenticated user in the same organization.

"This is a key aspect of the infection chain; if TA488 has access to other accounts in the organization, the group maintains persistent access to the target's mailbox," the researchers pointed out. "This persistent access lives on the server-side and requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user's device will not evict the actor."

Furthermore, the malware creates a second persistence method by adding a hidden iframe element to messages stored in OWA's offline IndexedDB message cache and enabling caching. The iframe is executed each time the victim opens a malicious email from the cache, thereby re-infecting the target even after a host is re-imaged.

OWAReaper is also notable for employing two methods for command-and-control (C&C or C2): using GitHub or attacker-sent emails to parse commands and execute them on the host. The script queries GitHub's Commit Search API every 24 hours for commit messages containing the target's email address.

If it finds one, the data is parsed and decrypted using a hard-coded key from the JavaScript and a per-session AES key, likely in an attempt to prevent other parties from extracting the commands. The decoded data contains a four-character header that denotes a specific command type -

• code, to replace OWAReaper's entire toolkit code
• domn, to rotate the C&C servers
• cmnd, to execute arbitrary JavaScript code via eval()

Alternatively, OWAReaper can parse inbound emails sent from TA488 operators to process and run the same types of commands observed in the GitHub method. It checks the IndexedDB for message bodies with the {target_email_address}{space}{Base64text} structure.

Data exfiltration is accomplished primarily over HTTPS with AES-CTR encrypted URI paths. Should this approach fail, the malware uses DNS label tunneling to smuggle data within standard DNS queries of an actor-controlled domain.

Proofpoint noted that the earliest infrastructure used in this campaign was created in March 2026, two months before Microsoft disclosed CVE-2026-42897, raising the possibility that it may have been exploited as a zero-day. The company also said it did not detect any activity from TA488 between February and July 22, 2026.

"OWAReaper runs inside the OWA browser context, operating as a stealthy implant with no host footprint, using two C&C communication channels and two data exfiltration protocols," Proofpoint said. "It is capable of surviving browser reboots, credential rotation, and full re-imaging of the victim's device."

"Based on newly observed activity, TA488 appears to demonstrate interest in a wide range of sectors while maintaining priorities for intelligence collection against government and defense. Lure themes remain generic and unremarkable, so the target is more inclined to open and skim the email but ultimately overlook it."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.