Russian Hackers Use Exchange Zero-Day in Email Attacks

Russia-aligned cyberespionage group Laundry Bear, also tracked as Void Blizzard and TA488, is exploiting a Microsoft Exchange Outlook Web Access (OWA) vulnerability to deploy a browser-based backdoor capable of maintaining access to victims' mailboxes even after credentials are changed or systems are reimaged.

Email security firm Proofpoint said it observed the campaign targeting government organizations in the US and Europe, as well as telecommunications, financial, hospitality and aerospace organizations. The activity uses OWAReaper, a sophisticated backdoor delivered through malicious emails exploiting CVE-2026-42897.

CVE-2026-42897 is a cross-site scripting vulnerability caused by inadequate HTML sanitization in OWA. A specially crafted email can contain malicious JavaScript that executes when the recipient opens the message in OWA. Proofpoint calls the technique a "half-click" exploit because opening the email can be enough to trigger the attack, without requiring the victim to click a link or open an attachment. Microsoft disclosed the vulnerability on May 14, 2026, and confirmed active exploitation.

Proofpoint found that infrastructure associated with the campaign had been established as early as March, nearly two months before Microsoft's disclosure, suggesting TA488 may have exploited the vulnerability as a zero-day. The group used ordinary-looking subjects concerning supply chains, research updates, tourism, gas markets and other industry-related information, making the messages less likely to be treated as malicious.

The emails contained JavaScript loaders and Base64-encoded payload fragments hidden within URLs associated with social-media-style icons. Once triggered, the code assembled and executed the OWAReaper payload.

OWAReaper operates entirely within the OWA reading pane. It can collect the victim's email address, username and Outlook configuration, while also attempting to capture credentials by creating invisible DOM elements that allow the browser's autofill mechanism to populate usernames and passwords.

The backdoor's most concerning capability is its persistence. It searches for Outlook add-ins with "ReadWriteMailbox" permissions and can use the "GetClientAccessToken" operation to obtain OAuth tokens. It then abuses Exchange's "UpdateFolder" operation to grant Owner-level permissions to the "Default" user across the victim's mail folders.

Because these permissions are stored server-side, changing the victim's password or reinstalling the compromised computer does not necessarily remove the attacker's access. OWAReaper also enables browser caching and places a malicious iframe into messages stored in OWA's offline IndexedDB database, allowing the payload to execute again when a poisoned message is opened from the cache.

The malware uses multiple channels for command and control. It periodically searches GitHub commit messages for encrypted commands containing the victim's email address and can also receive commands through specially formatted emails stored in OWA's cache.

For data theft, OWAReaper primarily uses HTTPS with encrypted URI paths that can be routed through image CDN services. It also has a direct-server fallback and a DNS-based exfiltration mechanism that encrypts and Base32-encodes stolen data before transmitting it through DNS queries.

Proofpoint linked OWAReaper to TA488 based on behavioral similarities with ZimReaper, malware previously used by the group against Zimbra email servers. In that campaign, TA488 exploited another XSS flaw, CVE-2025-66376, to steal emails, passwords, application passcodes and two-factor authentication codes.

The latest campaign therefore represents an evolution of the group's "half-click" approach, shifting from compromising individual webmail sessions toward establishing persistent access within the victim's mailbox environment.

Microsoft has since released security updates addressing CVE-2026-42897. The July 2026 Exchange Server update states that the code fix is available, while organizations that previously applied Microsoft's mitigation must follow Microsoft's guidance to remove it after installing the update. The vulnerability affects on-premises Exchange Server deployments, while Exchange Online is not affected.

Proofpoint has published indicators of compromise for the campaign, including malicious domains and the HTML message body containing the exploit and OWAReaper payload. Organizations using affected on-premises Exchange deployments should therefore investigate not only compromised endpoints, but also mailbox permissions, OAuth tokens and OWA browser storage when responding to suspected exploitation.

Read the original article: