Overview
- Proofpoint traced an active campaign that began on July 22, 2026 in which the Russia-linked group TA488, also called Laundry Bear, used CVE-2026-42897 in on-premises Outlook Web Access to deliver a JavaScript implant named OWAReaper.
- The attack uses a “half-click” cross-site scripting technique that runs when a victim merely opens an email in OWA, reconstructs a Base64 payload from message HTML, and executes the loader inside the authenticated OWA reading pane.
- OWAReaper creates dual persistence by storing an encrypted loader in the browser (localStorage/IndexedDB) and by changing mailbox state on the server, including stealing OAuth tokens and granting Owner-level permissions to the Default principal on folders.
- The implant uses two command channels—GitHub commit messages and attacker-sent emails—and two exfiltration methods—HTTPS routed through image CDNs with a DNS tunneling fallback—making detection and disruption harder.
- Microsoft has released fixes for CVE-2026-42897 but unpatched on-premises OWA remains at risk, so defenders must patch, audit and revoke OAuth tokens, remove Default:Owner folder grants, clear OWA localStorage and IndexedDB, and hunt mailbox and GitHub API indicators because changing passwords or re-imaging devices may not remove access.