Email security firm **Proofpoint** recently uncovered a sophisticated campaign by the Russian state-sponsored hacking group **Laundry Bear**, also tracked as **Void Blizzard** or **TA488**. The group is actively exploiting a zero-day vulnerability in **Microsoft Exchange Outlook Web Access (OWA)** to deliver a new backdoor dubbed **OWAReaper**. This activity, first observed by Proofpoint a week prior, targets a diverse range of organizations including U.S. and European government entities, as well as companies in the telecommunications, financial, hospitality, and aerospace sectors. ### The 'Half-Click' Exploit The exploit leverages **CVE-2026-42897**, a cross-site scripting (XSS) vulnerability. This flaw allows attackers to execute arbitrary JavaScript within the browser context simply by having a user open a specially crafted email in the **OWA** application. Proofpoint researchers refer to this as a 'half-click exploit' because user interaction is minimal – merely opening the malicious email is sufficient to trigger the vulnerability. This technique mirrors previous attacks by **Laundry Bear**, where they exploited **CVE-2025-66376**, an XSS vulnerability in **Zimbra** email servers, to deliver the **ZimReaper** malware for email theft. ### Improper HTML Sanitization and Advanced Tradecraft In a recent report, Proofpoint highlighted the **OWAReaper** campaign as a significant advancement in **Laundry Bear**'s tradecraft. **Microsoft**'s advisory on May 14 confirmed that **CVE-2026-42897** was being actively exploited as a zero-day. The vulnerability stems from the server's improper sanitization of HTML code within the message body, enabling the injection and execution of malicious JavaScript. Proofpoint's analysis indicates that **TA488** established the attack infrastructure for **OWAReaper** in March, nearly two months before Microsoft's public warning. Attackers craft emails with banal subject lines and lures, such as supply-chain analyses, research updates, or market performance indicators. This strategy aims to encourage recipients to open and skim the message without suspicion, as there are no obvious malicious URLs or attachments. The malicious messages embed a JavaScript loader and Base64-encoded payload blobs within social media icon URLs, effectively hiding the malicious code.  **Improper HTML sanitization triggers JavaScript loader** *source: Proofpoint* ### OWAReaper: A Sophisticated Backdoor **OWAReaper** is described as the most sophisticated backdoor delivered via half-click exploits observed to date. It executes entirely within the **OWA** reading pane. Upon execution, it uses **Outlook APIs** to rewrite the email on the **Exchange server**, removing the exploit content, and simultaneously disables **OWA** pop-ups and right-click functionality. The malware collects the compromised account's email address, username, and Outlook settings. It also attempts to steal access credentials by creating invisible elements in the Document Object Model (DOM), waiting for the browser's autofill function. ### Unprecedented Long-Term Persistence A critical finding by Proofpoint researchers is **OWAReaper**'s ability to maintain access to a target's mailbox even after system restoration or credential rotation. This is achieved through several advanced persistence mechanisms. Firstly, **OWAReaper** checks for installed Outlook add-ins with `ReadWriteMailbox` permissions. It then leverages the `GetClientAccessToken` operation request to steal **OAuth tokens**. Subsequently, it calls `UpdateFolder` to grant itself Owner-level permissions to the 'Default' user (a low-permission preset alias in all **Microsoft Exchange** tenants) across all mail folders. This grants attackers access to the mailbox from any authenticated account within the organization, making credential changes or system reinstallation ineffective at revoking access. Secondly, **OWAReaper** establishes persistence by enabling caching and injecting a malicious iframe into the HTML of messages stored in **OWA**'s offline IndexedDB. This iframe executes every time the victim opens a poisoned email from the cache. ### Dual Command-and-Control and Exfiltration **OWAReaper** employs redundant command-and-control (C2) mechanisms. One method utilizes **GitHub** commit messages, with the malware querying **GitHub**'s Commit Search API every 24 hours for encrypted messages matching a specific format and including the target's email address. Alternatively, the malware can parse emails delivered to the target’s mailbox, looking for messages in the IndexedDB with a specific `{target_email_address}{space}{Base64text}` structure. For data exfiltration, **Laundry Bear** also uses two primary methods. The main method involves HTTPS with AES-CTR encrypted URI paths, proxied through certain image content delivery network (CDN) domains. If this fails, data is delivered directly to the attacker’s server, with a DNS exfiltration fallback mechanism where data is encrypted and then Base32-encoded into DNS packets. Proofpoint attributed the **OWAReaper** campaign to **TA488** based on behavioral overlaps with previous **ZimReaper** activity and the consistent use of half-click XSS exploits to target webmail viewers for espionage. Indicators of Compromise (IoCs), including domains and specific HTML message body content related to the **CVE-2026-42897** exploit and the **OWAReaper** payload, have been published by the researchers.