Proofpoint calls OWAReaper “the most sophisticated backdoor delivered via half-click exploits” they have seen — and it arrived after the attacker assembled infrastructure in March, almost two months before Microsoft issued a May 14 advisory for the underlying Exchange OWA flaw, CVE-2026-42897.
CVE-2026-42897 in Exchange OWA
Proofpoint says the Russian state-sponsored group Laundry Bear (also tracked as TA488 and Void Blizzard) exploited CVE-2026-42897, a cross-site scripting (XSS) flaw in Exchange Outlook Web Access (OWA). The vulnerability stems from improper HTML sanitization in the message body and allows arbitrary JavaScript to execute in the victim’s browser when a specially crafted email is opened in the OWA reading pane. Proofpoint describes this class of attack as a “half-click exploit,” because users need only open or skim the message to trigger the JavaScript.
OWAReaper: the backdoor and persistence mechanisms
Proofpoint’s analysis shows the exploit delivers a backdoor they name OWAReaper. The malware executes entirely inside the OWA reading pane, uses Outlook APIs to rewrite the email on the Exchange server (removing the exploit content), and disables OWA pop-ups and right-click while it runs. OWAReaper collects the compromised account’s email address, username, and Outlook settings and attempts to capture access credentials by creating invisible Document Object Model (DOM) elements and waiting for the browser to auto-fill them.
OWAReaper contains a suite of persistence mechanisms that allow access to survive credential rotation or system restoration. First, it checks for installed Outlook add-ins with ReadWriteMailbox permissions and abuses the GetClientAccessToken operation to steal OAuth tokens. It then calls UpdateFolder to grant Owner-level permissions to the 'Default' user on every mail folder, enabling the attacker to access the mailbox from any authenticated account within the organization. Because mailbox permissions are configured server-side, changes to the compromised user's credentials or reinstalling a system do not revoke that access.
A second persistence technique enables caching and injects a malicious iframe into the HTML of messages stored in OWA’s offline IndexedDB. That iframe executes whenever a victim opens a poisoned email from the cache, reactivating the attack without a new exploit payload.
TA488 (Laundry Bear) tradecraft: half-click XSS, covert C2, and exfiltration
Proofpoint observed Laundry Bear using subject lines and lures described as “banal” — supply-chain analyses, research updates, and performance indicators for tourism and gas markets — likely intended to encourage opening and quick dismissal so recipients do not report the messages. The malicious messages contained a JavaScript loader and Base64-encoded payload blobs embedded in social media icon URLs after the ‘#’ character.
OWAReaper supports two command-and-control mechanisms. One queries GitHub’s Commit Search API every 24 hours for encrypted messages matching a specific format that includes the target’s email address. The other parses emails in the target mailbox, checking the IndexedDB for message bodies with the structure {{target_email_address}}{{space}}{{Base64text}}. For exfiltration, Proofpoint documents a primary method using HTTPS with AES-CTR–encrypted URI paths proxied through certain image content delivery network (CDN) domains; if that fails, data is delivered directly to an attacker-controlled server. A DNS exfiltration fallback encodes encrypted data using Base32 into DNS packets.
Connections to earlier Zimbra attacks and attribution
Proofpoint links OWAReaper to earlier ZimReaper activity and previously observed zero-day use of CVE-2025-66376 against Zimbra email servers. The researchers attribute the campaign to TA488 based on behavioral overlaps — notably the repeated use of half-click XSS exploits against webmail viewers to support espionage goals. Proofpoint published a limited set of indicators of compromise, including domains and the HTML message body containing the CVE-2026-42897 exploit and the OWAReaper payload.
What this means for security teams, enterprise owners, and regulators
- Security teams: Expect exploits that run entirely in webmail readers and remove traces from the visible message. Look for server-side mailbox permission changes (Owner-level grants to the 'Default' alias), anomalous GetClientAccessToken activity, and unexpected IndexedDB entries with injected iframes. Proofpoint’s IoCs are published and should be incorporated into detection rules.
- Enterprise owners and IT operators: Because the attacker’s mailbox access can survive credential rotation and system re-imaging by exploiting server-side folder permissions, remediation may require reviewing and resetting mailbox folder permissions and scrutinizing installed Outlook add-ins for ReadWriteMailbox scope.
- Regulators and oversight bodies: The campaign demonstrates a capability to sustain covert access to mailboxes across tenant users; published exploitation of a zero-day prior to vendor advisory underlines the importance of timely alerts and sharing of indicators for affected sectors named by Proofpoint (government entities in the U.S. and Europe; telecommunications, financial, hospitality, and aerospace firms).
Proofpoint’s briefing portrays an adversary that refined a prior technique, automated covert command channels, and layered persistence so that a single opened message can yield long-term mailbox compromise. The record ends with a practical artifact set — IoCs and behavioural indicators — that defenders must fold into monitoring and incident response to counter an attacker already operating in the wild.
