Russian threat actors, identified as **Laundry Bear** (also known as CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard), are actively exploiting a previously patched vulnerability in **Microsoft Outlook Web Access (OWA)**. This new wave of attacks, which began on July 22, 2026, targets government entities in the U.S. and Europe, as well as organizations within the telecommunications, financial, hospitality, and aerospace sectors. ### Exploiting CVE-2026-42897 The campaign weaponizes **CVE-2026-42897** (CVSS score: 8.1), a cross-site scripting (XSS) vulnerability within OWA. **Microsoft** had already flagged this flaw as being exploited in attacks as early as May 2026. Enterprise security firm **Proofpoint** has attributed this activity to **Laundry Bear**, the same group recently linked to the zero-day exploitation of **CVE-2025-66376**, an XSS flaw in **Zimbra**'s Classic UI, starting in July 2025. ### The 'Half-Click' Exploit Strategy **TA488** is refining its 'half-click' exploit strategy, where merely opening an email is sufficient to trigger a compromise. This marks a significant improvement in the group's tradecraft, incorporating enhanced loading mechanisms, techniques, and malware. Similar to their previous operations, these attacks utilize compromised accounts to send phishing emails. The high volume and broad targeting of these messages are a departure from earlier **TA488** campaigns, suggesting an intentional effort to blend in with mass spam and evade detection.  The emails feature vague lures, such as informational updates on supply chain analyses, research, or market metrics, requiring no action from the recipient. This generic approach is a hallmark of **TA488**'s 'half-click' exploit chains, designed to appear legitimate and avoid suspicion by omitting URLs or attachments. This increases the likelihood that a recipient will open and read the message, inadvertently triggering the exploit for **CVE-2026-42897**. **Proofpoint** researchers explain that a JavaScript loader utilizes the `onload=` event handler to parse the message body, assemble a Base64 fragment, and execute it. The initial exploit trigger and payload data are cleverly embedded within social media icons and after '#' symbols in the message body's HTML. ### Introducing OWAReaper The exploitation of **CVE-2026-42897** culminates in the deployment of **OWAReaper**, a sophisticated, previously unknown JavaScript browser-based implant. This malware is specifically designed for persistent access within **Microsoft**'s webmail client. **OWAReaper** is an evolution of **ZimReaper**, sharing significant source code and behavioral overlaps. It executes within the OWA reading pane and then uses **Outlook** APIs to rewrite the email on the **Exchange** server, effectively removing the exploit content.  ### Persistence and Data Exfiltration Once active, **OWAReaper** disables OWA pop-ups and right-click functionality. It creates a unique session key for the target and gathers the victim's email address, username, and **Outlook** settings. It also creates two invisible input elements in the web page's Document Object Model (DOM) to capture OWA saved credentials via the browser's autofill feature. For persistence, the malware writes an encrypted version of itself and a decryption wrapper into the browser's localStorage, ensuring automatic execution whenever an unsuspecting user opens an OWA tab. **OWAReaper** further enhances its persistence by checking for installed **Outlook** add-ins with `ReadWriteMailbox` permissions. If found, it exploits them to steal **OAuth** tokens and grant itself Owner-level permissions to the Default user on every mail folder. This grants complete mailbox access to any authenticated user within the same organization. **Proofpoint** researchers highlight a critical aspect: "This persistent access lives on the server-side and requires deliberate removal from the **Exchange** server; credential rotation and even full re-imaging of the targeted user's device will not evict the actor." Another persistence method involves adding a hidden iframe element to messages stored in OWA's offline IndexedDB message cache. This iframe executes each time a victim opens a malicious email from the cache, re-infecting the target even after a host re-image. ### Command and Control (C2) and Exfiltration **OWAReaper** utilizes two methods for command-and-control (C2): **GitHub** or attacker-sent emails. The script queries **GitHub**'s Commit Search API every 24 hours for commit messages containing the target's email address. If found, the data is parsed and decrypted using a hard-coded key and a per-session **AES** key, likely to prevent external command extraction. Decoded data contains a four-character header denoting specific command types: * `code`: Replaces **OWAReaper**'s entire toolkit code. * `domn`: Rotates the C2 servers. * `cmnd`: Executes arbitrary JavaScript code via `eval()`. Alternatively, **OWAReaper** can parse inbound emails from **TA488** operators, checking the IndexedDB for message bodies structured as `{target_email_address}{space}{Base64text}` to process and run the same commands. Data exfiltration primarily occurs over HTTPS with **AES-CTR** encrypted URI paths. If HTTPS fails, the malware resorts to DNS label tunneling to smuggle data within standard DNS queries to an attacker-controlled domain. **Proofpoint** notes that the earliest infrastructure for this campaign was established in March 2026, two months before **Microsoft** disclosed **CVE-2026-42897**, suggesting a possible zero-day exploitation. The firm also observed no activity from **TA488** between February and July 22, 2026, before the current campaign surged. "**OWAReaper** runs inside the OWA browser context, operating as a stealthy implant with no host footprint, using two C&C communication channels and two data exfiltration protocols," **Proofpoint** concluded. "It is capable of surviving browser reboots, credential rotation, and full re-imaging of the victim's device." This new activity underscores **TA488**'s evolving capabilities and its continued focus on intelligence collection against government and defense targets, while broadening its reach across various sectors with generic, unassuming lures.