"This persistent access lives on the server-side and requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user's device will not evict the actor."
TA488 returns with CVE-2026-42897 and broad targeting
Beginning July 22, 2026, Proofpoint observed Russian-linked threat actors tied to Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) weaponizing CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA) with a CVSS score of 8.1. Microsoft flagged that the flaw had been exploited in attacks as far back as May 2026. Proofpoint says the activity targeted U.S. and European government entities and organizations in the telecommunications, financial, hospitality, and aerospace sectors.
The campaign reused a pattern familiar from TA488’s earlier work against Zimbra: adversary-controlled Proton Mail accounts and previously compromised addresses sent messages that triggered a browser-executed exploit simply by being opened — a so-called “half-click” chain. Proofpoint researchers Greg Lesnewich, Stuart Del Caliz, Nick Attfield, Konstantin Klinger, Saher Naumaan, and Mark Kelly said, “TA488 is doubling down on the use of 'half-click' exploits - where opening the email is enough to trigger compromise - with significantly improved loading mechanisms, techniques, and malware, signaling an improvement in the group's tradecraft and capability.”
OWAReaper: a browser implant built for stealth and persistence
Proofpoint describes a JavaScript implant, OWAReaper, delivered in the OWA reading pane and built to maintain access inside Microsoft’s webmail client. Once executed, the implant uses Outlook APIs to rewrite the email on the Exchange server and remove the exploit content, disables OWA pop-ups and right-click, and creates a unique session key. It gathers the target’s email address, username, and Outlook settings, and creates invisible input elements to capture saved OWA credentials via browser autofill.
OWAReaper then writes an encrypted copy of itself and a decryption wrapper into the browser’s localStorage so the script runs automatically whenever an OWA tab is opened. The implant also checks for installed Outlook add-ins with ReadWriteMailbox permissions; when such add-ins are present it can steal OAuth tokens and “grant[s] itself Owner-level permissions to the Default user on every mail folder,” a mechanism Proofpoint highlights as the pathway to complete mailbox access across an organization.
“OWAReaper runs inside the OWA browser context, operating as a stealthy implant with no host footprint, using two C&C communication channels and two data exfiltration protocols,” Proofpoint said.
Delivery techniques and hidden payload mechanics
The phishing messages observed were deliberately generic — supply-chain analyses, research updates, tourism or gas-market metrics — and excluded URLs or attachments to encourage recipients to open and skim them. Proofpoint found the initial loader used the onload= event handler to parse message bodies, assemble Base64 fragments, and execute encoded JavaScript. The exploit trigger and payload blobs were hidden in social-media icons in the email HTML, with next-stage payload data stored after “#” symbols so browsers would stop parsing them when loading images from Base64.
Proofpoint noted the volume and breadth of these messages represented an intentional blending with mass-mailing spam to reduce detection.
Dual command-and-control, exfiltration channels, and infrastructure timing
OWAReaper uses two C2 methods: polling GitHub’s Commit Search API every 24 hours for commit messages containing the target’s email address and parsing inbound emails from operators found in IndexedDB for messages with a {{target_email_address}}{{space}}{{Base64text}} structure. GitHub-based commands are encrypted with a hard-coded key and a per-session AES key; decoded payloads begin with a four-character header denoting actions — “code” to replace OWAReaper’s toolkit, “domn” to rotate C&C servers, and “cmnd” to execute arbitrary JavaScript via eval().
Data exfiltration flows primarily over HTTPS with AES-CTR encrypted URI paths, with DNS label tunneling used as a fallback. Proofpoint also reported the earliest infrastructure for this campaign was created in March 2026 — two months before Microsoft’s May disclosure of CVE-2026-42897 — “raising the possibility that it may have been exploited as a zero-day.” Proofpoint added it did not detect TA488 activity between February and July 22, 2026.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: hunt for server-side persistence and mailbox permission changes — Proofpoint warns that deliberate removal from the Exchange server is required to evict the actor — inspect IndexedDB and localStorage for hidden iframes and encrypted payloads, and audit Outlook add-ins with ReadWriteMailbox privileges that could be abused to steal OAuth tokens.
- Policymakers and regulators: the March 2026 creation of campaign infrastructure, before Microsoft’s public flagging, underscores timelines and disclosure sequencing that may warrant review where supplier and vulnerability-disclosure practices overlap with national-targeting concerns.
- Affected enterprises and procurement leaders: expect broadly distributed, low-signal phishing lures sent from compromised internal addresses and third-party mail providers; the campaign’s design aims to remain unnoticed in mass mailings while delivering a browser-resident implant that survives credential rotation and host re-imaging unless Exchange server-side artifacts are removed.
The observed campaign marks an evolution from ZimReaper to OWAReaper: refined half-click delivery, browser-resident persistence, and layered C2 and exfiltration methods that place removal responsibility on the mail server rather than the endpoint. Proofpoint’s timeline — infrastructure predating public flagging — leaves open a critical operational question for defenders and vendors alike: how long can a stealthy webmail implant persist across an organization before discovery and deliberate server-side remediation halt it?
https://thehackernews.com/2026/07/russian-hackers-exploit-microsoft-owa.html
