Russian state-linked hackers known as Laundry Bear are exploiting an Exchange OWA zero-day to gain persistent access to victims’ mailboxes. The campaign uses specially crafted emails to deploy a sophisticated browser-based backdoor named OWAReaper.
Proofpoint detected the activity targeting government organisations in the US and Europe, as well as firms in telecommunications, finance, hospitality and aerospace. The attacks require victims to open a malicious email in Outlook Web Access.
Malicious emails exploit an Outlook Web Access flaw
Laundry Bear, also known as Void Blizzard and TA488, exploited CVE-2026-42897. The vulnerability is a cross-site scripting flaw in Outlook Web Access that allows arbitrary JavaScript to run in the browser when a user opens a specially crafted message.
Researchers describe this technique as a “half-click exploit.” Victims do not need to open an attachment or visit a malicious website. Simply viewing the email in the OWA reading pane can trigger the attack.
Microsoft disclosed the vulnerability in May 2026. However, Proofpoint says the threat actor had already prepared infrastructure for the OWAReaper campaign in March, suggesting exploitation began before the public advisory.
Improper HTML sanitisation enables the attack
CVE-2026-42897 exists because the server does not properly sanitise HTML code in email message bodies. Attackers can abuse this weakness to add malicious HTML and JavaScript to an email.
The observed messages used ordinary-looking subjects related to supply-chain analysis, research updates, tourism markets and gas-market performance. These lures were designed to encourage recipients to open and briefly read the message without suspecting an attack.
No suspicious links or attachments were needed. Instead, the malicious emails contained a JavaScript loader and Base64-encoded payload data hidden in social media icon URLs after the # character.
Once the victim opened the message, the code launched OWAReaper within the Outlook Web Access reading pane.
OWAReaper hides its activity in the mailbox
OWAReaper runs entirely inside the victim’s browser session. After execution, it uses Outlook APIs to rewrite the malicious email on the Exchange server and remove the exploit content.
At the same time, the backdoor can disable OWA pop-ups and right-click functionality while it operates. These measures make the activity harder for victims to notice.
The malware collects information about the compromised account, including the email address, username and Outlook settings. It also attempts to steal stored credentials by creating invisible page elements and waiting for the browser to fill them automatically.
Proofpoint described OWAReaper as the most advanced backdoor it has seen delivered through a half-click webmail exploit.
Attackers can retain access after credential resets
The most serious feature of the campaign is its ability to establish long-term mailbox access. OWAReaper checks for Outlook add-ins with ReadWriteMailbox permissions and uses them to steal OAuth tokens through the GetClientAccessToken operation.
It then uses the UpdateFolder request to assign Owner-level access to the low-privilege Default user across every folder in the mailbox.
This server-side permission change allows attackers to access the mailbox from any authenticated account in the organisation. Resetting the victim’s password or rebuilding their device will not remove that access.
A second persistence method targets Outlook Web Access offline storage. The malware enables caching and inserts a malicious iframe into messages stored in OWA’s IndexedDB cache.
That iframe can run each time a victim opens a poisoned message from the local cache.
OWAReaper uses several command channels
The backdoor supports two command-and-control methods. One method checks GitHub commit messages for encrypted instructions that include the target’s email address.
Every 24 hours, OWAReaper queries GitHub’s Commit Search API for messages matching a specific format. The malware can also receive commands through specially structured emails delivered to the compromised mailbox.
For data theft, the primary method sends encrypted information through HTTPS requests routed via selected image CDN domains. If that route fails, the malware can send data directly to attacker-controlled infrastructure.
It also includes a DNS exfiltration fallback. Before sending the data, OWAReaper encrypts it and encodes it using Base32.
Campaign linked to earlier Zimbra attacks
Proofpoint linked the operation to Laundry Bear based on its behaviour, infrastructure and use of half-click webmail exploits. The group previously exploited a Zimbra zero-day to deploy ZimReaper, malware that stole email content, two-factor authentication codes, app passwords and credentials.
The latest Exchange OWA zero-day campaign shows a clear evolution in the group’s capabilities. Organisations using Outlook Web Access should apply Microsoft’s available security updates, review mailbox permissions and investigate unusual add-in activity, OAuth token use and suspicious email content.
0 responses to “Russian Hackers Exploit Exchange OWA Zero-Day for Mailbox Access”