"the most sophisticated half-click backdoor it has seen," Proofpoint wrote, describing a new implant deployed by a Russia-aligned espionage group that returned to operations in late July.
TA488 resurfaced and used CVE-2026-42897
Proofpoint's research, published on July 29, reports that the actor tracked as TA488 — also known as Void Blizzard and Laundry Bear — began a campaign on July 22 after months with no observed activity. The messages exploited CVE-2026-42897, a cross-site scripting flaw affecting on-premises Exchange Server (not Exchange Online). Proofpoint said the group's infrastructure dates to March 2026, roughly two months before Microsoft disclosed the flaw, making zero‑day use feasible.
OWAReaper: a browser-resident implant and server-side persistence
The payload Proofpoint uncovered is named OWAReaper, a JavaScript implant that ran entirely inside the Outlook Web Access (OWA) reading pane and left no conventional file on disk. Proofpoint described OWAReaper as building on ZimReaper from the group's earlier Zimbra campaigns while dropping that tool's mass email exfiltration. The implant rewrote the original message on the server to strip the exploit, harvested saved credentials, and hid an encrypted copy of itself in browser localStorage under a legitimate OWA settings key so each new tab re‑executed the code.
OWAReaper's more durable mechanisms were server-side. Where add-ins with mailbox write permissions existed, the implant stole OAuth tokens and granted Exchange's low-privilege Default user Owner‑level permissions on every mail folder — effectively opening the mailbox to any authenticated account in the organization. The actor also planted a hidden iframe in messages held in OWA's offline IndexedDB cache; that iframe could re‑infect the target even after the host was re‑imaged. Because the folder-permission grant lived server-side and required deliberate removal from Exchange, credential rotation and device re‑imaging did not evict the actor.
Delivery, command channels and data exfiltration
The attack required only that a target open an email in a vulnerable OWA client: the embedded JavaScript executed within the victim's authenticated session, a “half‑click” technique that requires no additional link or attachment. Lures were deliberately unremarkable — subject lines covered semiconductor supply chains, gas markets and tourism metrics — a composition Proofpoint suggested was intended so recipients would skim and dismiss messages without reporting them.
Commands were delivered through two channels: GitHub commit messages queried daily, and inbound emails polled every five minutes. Exfiltration moved over HTTPS proxied through legitimate image content delivery networks, with a fallback to DNS tunneling.
Targets and campaign volume
Proofpoint observed targeting across US and European government entities and the telecommunications, financial, hospitality and aerospace sectors. The company noted the campaign volume was unusual for TA488 and suggested the higher volume may have been deliberate so the activity could blend into mass‑mailing spam.
What this means for government entities, technologists, and affected enterprises
- Government entities targeted across the US and Europe will need to consider server‑side persistence vectors that survive credential rotation and host re‑imaging, since the actor's folder‑permission grants and IndexedDB iframe can persist beyond device remediation.
- Technologists and security teams should prioritize the specific mitigations Proofpoint recommended: revoke Exchange Web Services tokens, strip Default‑user folder grants, and clear OWA's offline IndexedDB and the localStorage key where the implant hid its encrypted copy.
- Affected enterprises in telecommunications, finance, hospitality and aerospace should treat apparently banal, high‑volume mailings with scrutiny: Proofpoint argued the group's use of ordinary subject lines appears intended to reduce reporting and avoid link/attachment‑based detections.
Microsoft has released Exchange security updates addressing CVE-2026-42897; Proofpoint's advisory frames those updates alongside defensive steps that reach beyond patching because the actor's persistence mechanisms live on mail servers and in browser storage. Removal can require deliberate server‑side actions and clearing of client storage keyed to legitimate OWA settings. The combination of a half‑click exploit, browser‑resident implant and server‑level folder grants makes this campaign notable for defenders confronting threats that do not rely on traditional file‑based footprints.
Original reporting: https://www.infosecurity-magazine.com/news/ta488-outlook-half-click-owareaper/
