Threat researchers report that a Russian state-sponsored hacking group is using an Exchange OWA zero-day to gain not just short-lived access, but durable, long-term control of victims’ mailboxes. The activity centers on carefully crafted email messages that exploit a vulnerability in Outlook Web Access to launch a sophisticated backdoor named OWAReaper.
The campaign was observed in email attacks targeting a range of organizations, including government entities in the U.S. and Europe, as well as companies in telecommunications, financial services, hospitality, and aerospace. According to Proofpoint, the group behind the operation is tracked as TA488 and is also associated with aliases such as Laundry Bear and Void Blizzard.
What the Exchange OWA zero-day enables
The core of the intrusion is a vulnerability in Outlook Web Access known as CVE-2026-42897. The flaw relates to improper HTML sanitization in message bodies. In practical terms, it allows attackers to execute JavaScript in the victim’s browser context when a user opens a specially prepared message inside the OWA app.
This behavior fits Proofpoint’s description of a “half-click exploit.” The victim doesn’t need to actively interact with links or attachments; simply opening the malicious email in the reading view triggers the exploit.
Microsoft published an advisory for CVE-2026-42897 on May 14, but Proofpoint indicates the threat actor was already exploiting it as a zero-day before that public notice.
From earlier XSS work to OWAReaper
This is not the group’s first attempt to weaponize webmail interfaces. Proofpoint previously observed the same threat actors abusing another XSS vulnerability, CVE-2025-66376, as a zero-day in Zimbra email servers. That earlier malware, ZimReaper, focused on stealing email communications as well as authentication material such as two-factor authentication (2FA) codes, application passcodes, and passwords.
In the OWA campaign, Proofpoint says TA488 improved its tradecraft by building a new backdoor delivery chain around OWA’s vulnerability. Rather than relying on a single exploitation step, the attackers crafted messages that include JavaScript loaders and payload content embedded in a way that is difficult to spot at a glance.
Why the phishing lures look ordinary
One detail that stood out to researchers is the choice of email subject lines. Proofpoint notes that the lure topics appear banal and aligned with what a target might plausibly skim rather than report. Examples mentioned in the reporting include supply-chain analyses, research updates, and performance indicators related to tourism and gas markets.
Importantly, Proofpoint also points out that these emails reportedly contain no suspicious URLs or attachments. The malicious behavior is driven by the webmail viewer itself—when the message is opened, the vulnerable sanitization fails and the injected code runs.
How OWAReaper executes inside the reading pane
Proofpoint describes the backdoor as particularly advanced. It states that OWAReaper runs entirely in the Outlook Web Access reading pane. Once executed, the malware uses Outlook APIs to modify the email on the Exchange server and remove exploit content. At the same time, it restricts user interface interactions—such as disabling pop-ups and right-click—while it carries out its work.
From there, the malware collects information from the compromised context, including the email address, username, and Outlook settings of the affected account. It also attempts to steal access credentials by creating invisible elements in the browser’s DOM and waiting for the browser to automatically populate them.
Long-term persistence: staying even after cleanup
What makes the campaign especially concerning is persistence that can survive common response actions. Proofpoint reports that TA488 can maintain mailbox access even if the victim system is restored from a clean image or if credentials are rotated.
One persistence mechanism is tied to OAuth tokens and Outlook add-ins. OWAReaper checks for installed Outlook add-ins with ReadWriteMailbox permissions. It then attempts to steal OAuth tokens using a request associated with GetClientAccessToken.
Next, the malware calls UpdateFolder to grant itself Owner-level permissions for the “Default” user alias (a low-permission preset used across Exchange tenants). Proofpoint explains that the result is broad mailbox access: attackers can reach the mailbox from any authenticated account within the organization.
Because these permission changes occur on the server side, simply changing the compromised user’s credentials or reinstalling the affected system does not remove the attacker’s foothold.
Second persistence: offline cache and an injected iframe
OWAReaper also implements a second persistence approach by leveraging offline storage. Proofpoint reports that the malware enables caching and injects a malicious iframe into the HTML of messages stored in OWA’s offline IndexedDB. When the victim later opens the affected message from cache, the injected iframe executes again.
This means that even if the email appears “clean” after the initial manipulation, the locally cached content can still re-trigger the malicious behavior.
Command-and-control through GitHub and inbox parsing
Proofpoint states the malware supports two command-and-control (C2) mechanisms to receive instructions from the attacker.
One method uses GitHub commit messages as the communication channel. Every 24 hours, the malware queries GitHub’s Commit Search API for encrypted messages that match a defined format and include the target’s email address.
In addition, OWAReaper can parse emails that are delivered into the target’s mailbox. It checks the IndexedDB for message bodies that follow a structure resembling {target_email_address}{space}{Base64text}. This gives the attacker another way to deliver commands using the victim’s own mail flow.
Data exfiltration with encryption and fallbacks
To move stolen data out, Proofpoint reports two exfiltration paths. The primary method uses HTTPS with AES-CTR encrypted URI paths. Those requests are designed to be proxied through certain content delivery network (CDN) domains.
If the primary exfiltration approach fails, the malware can send the data directly to the attacker’s server. Proofpoint notes that the destination is defined when the malware initializes outbound network sessions.
There is also a DNS-based fallback. In that scenario, the malware encrypts the data and then encodes it using a Base32 method before transmitting it in DNS packets.
Why this campaign matters for defenders
Security teams often rely on alerts, but Proofpoint’s reporting includes a reminder of how attacks can slip through. It references figures indicating that many successful intrusions may not trigger alerting early enough, meaning defenders can miss activity that remains “invisible” while it spreads.
From a defensive perspective, the most important takeaway is that the attack isn’t limited to the moment the email is opened. With server-side mailbox permissions, OAuth token abuse via add-ins, and offline cache re-execution, traditional response steps may not fully end attacker access.
Proofpoint published a small set of indicators of compromise (IoCs) as part of the reporting, including domains used in the activity and the HTML message body associated with the CVE-2026-42897 exploit and the OWAReaper payload.
Practical next steps to reduce risk
If your organization runs Exchange and uses Outlook Web Access, consider focusing on layered testing and detection. Evaluate whether your security tooling can identify half-click XSS attempts—especially cases where malicious JavaScript is delivered through email content and executes within the reading pane.
Also, review monitoring for signs of mailbox permission changes and suspicious use of OAuth token flows that involve add-ins with broad mailbox permissions. Because the persistence can persist after credential rotation, you’ll want controls that validate permissions and access on the server side, not only on endpoints.
Finally, test your SIEM and EDR detections against realistic attack paths, so threats don’t rely on gaps in visibility. The referenced approach in the reporting emphasizes breach and attack simulation to confirm your detections work end to end.
Conclusion
This campaign highlights how an Exchange OWA zero-day can be weaponized into a long-term compromise. By abusing CVE-2026-42897, attackers used half-click XSS email delivery to run OWAReaper in the OWA reading pane, then established persistence through mailbox permission changes and offline-cache re-execution.
For defenders, the lesson is clear: treat these incidents as more than a one-time exploit. Focus on server-side access controls, token and add-in monitoring, and detection testing that reflects how attackers actually operate.
