Security researchers have uncovered a sophisticated cyber espionage campaign conducted by a Russian-linked threat actor that leverages a recently patched vulnerability in Microsoft Outlook Web Access (OWA) to gain and maintain long-term access to victim email accounts across government and private-sector organizations.
The campaign, which began surfacing publicly in July 2026, exploits CVE-2026-42897, a high-severity cross-site scripting (XSS) vulnerability in OWA that Microsoft previously confirmed had been actively exploited since at least May 2026. The attacks have primarily targeted organizations across the United States and Europe, including entities in government, telecommunications, finance, aerospace, and hospitality sectors.
Researchers at Proofpoint attributed the activity to the threat group known as Laundry Bear (also tracked as TA488, Void Blizzard, CL-STA-1114, and UNK_PitStop), a state-sponsored actor previously linked to the exploitation of a Zimbra zero-day vulnerability used in espionage operations.
Evolution of Earlier Zimbra Attacks
The campaign follows a pattern previously observed in the group's attacks against vulnerable Zimbra webmail servers.
In those earlier operations, attackers used compromised accounts and attacker-controlled email addresses to distribute malicious emails exploiting a Zimbra cross-site scripting flaw. Simply viewing the email triggered exploitation, leading to the deployment of a JavaScript-based data theft tool known as ZimReaper. The malware was capable of collecting months of email communications and other sensitive information from victims.
Researchers now believe the group has significantly refined those techniques.
Instead of requiring users to click links or download attachments, the latest attacks rely on what researchers describe as "half-click" exploitation, where merely opening or previewing an email is sufficient to trigger compromise.
Generic Emails Conceal Advanced Unlike traditional phishing campaigns that attempt to lure victims into taking action, these emails deliberately appear mundane and unremarkable.
Examples include messages referencing:
- Supply chain reports
- Industry analysis
- Market research updates
- Tourism statistics
- Energy and gas sector metrics
The emails contain neither suspicious attachments nor embedded links, helping them evade security scrutiny while appearing legitimate.
The objective is simple: encourage recipients to open and briefly read the message.
That single action activates the exploit chain.
How the OWA Exploit Works
The attack leverages malicious JavaScript hidden within specially crafted email messages.
Researchers discovered that the exploit code is concealed within seemingly harmless social media icons embedded in the email's HTML content. Hidden payload fragments are stored using Base64-encoded data structures and reconstructed when the email is rendered inside OWA.
Once the message is loaded, JavaScript embedded in the email automatically executes and assembles the next-stage payload, triggering the infection chain without any further interaction from the victim.
The result is the deployment of a previously undocumented browser-based implant called OWAReaper.
OWAReaper: A Highly Advanced Webmail Backdoor
Proofpoint describes OWAReaper as one of the most advanced malware implants delivered through a half-click attack chain.
Built specifically for Microsoft's webmail environment, OWAReaper functions entirely within the browser session without writing traditional malware files to disk.
The malware shares architectural similarities with the previously observed ZimReaper platform but introduces significantly expanded capabilities.
Once activated, OWAReaper immediately:
- Collects victim account details
- Enumerates Outlook configuration settings
- Generates a unique session key
- Disables certain OWA security prompts
- Blocks right-click functionality during execution
The malware also modifies the underlying Exchange mailbox content, removing exploit artifacts from infected emails to reduce the likelihood of detection.
Credential Theft Through Browser Autofill Abuse
One particularly notable feature of OWAReaper involves credential harvesting.
The malware creates hidden form fields within the Outlook web interface. These invisible elements are designed to interact with the browser's built-in autofill functionality and silently capture stored Outlook credentials when the browser populates the fields.
The stolen information includes:
- Email addresses
- Usernames
- Saved authentication credentials
- Account configuration data
This provides attackers with additional access pathways even if initial infection mechanisms are detected.
Surviving Password Changes and Device Re-Imaging
Perhaps the most concerning aspect of OWAReaper is its ability to maintain persistence even after organizations perform traditional remediation actions.
After establishing itself, the malware stores an encrypted copy of its code inside the browser's local storage database. Each time the user opens Outlook Web Access, the malware reloads automatically.
Additionally, OWAReaper examines installed Outlook add-ins and identifies those possessing ReadWriteMailbox permissions.
If suitable add-ins are present, the malware can:
- Steal OAuth access tokens
- Modify mailbox permissions
- Grant broad access rights to other accounts
Researchers found that the malware elevates permissions on mailbox folders, allowing any authenticated user controlled by the attackers within the same organization to access the compromised mailbox.
This server-side persistence mechanism survives:
- Password changes
- Credential rotation
- Browser restarts
- Endpoint re-imaging
Because the persistence resides within Exchange and mailbox permissions, organizations must manually remove the malicious modifications to fully evict the attackers.
Secondary Persistence Mechanism
OWAReaper also establishes a backup persistence method through Outlook's offline message cache.
The malware inserts hidden iframes into stored email content held within the browser's IndexedDB database.
Whenever a victim opens one of these cached messages, the iframe executes and silently reinstalls the malware.
This means that even a fully rebuilt workstation can become re-infected if the compromised mailbox content remains accessible.
Command-and-Control Through GitHub and Email
The malware supports two separate command-and-control channels.
GitHub-Based Communications
OWAReaper periodically queries GitHub's Commit Search API searching for commits that contain the victim's email address.
When matching commits are discovered, encrypted commands are extracted and processed.
Supported commands include:
- Updating the malware's functionality
- Changing command-and-control infrastructure
- Executing arbitrary JavaScript code
Email-Based Communications
The malware can also receive commands through specially crafted emails sent directly to infected accounts.
It scans local Outlook data stores and processes encoded command structures embedded within inbound messages.
Both approaches help the attackers blend malicious activity into legitimate internet traffic patterns.
Advanced Data Exfiltration Techniques
To steal information, OWAReaper primarily relies on encrypted HTTPS communications.
If network restrictions interfere with HTTPS-based exfiltration, the malware falls back to DNS tunneling, embedding stolen information into DNS queries sent to attacker-controlled domains.
This redundancy greatly improves operational resilience and increases the likelihood that attackers can maintain communications even in monitored environments.
Potential Zero-Day Exploitation
Researchers noted that infrastructure associated with the campaign was established as early as March 2026, several months before Microsoft publicly disclosed the vulnerability.
This timing raises the possibility that the threat actors may have been exploiting CVE-2026-42897 as a zero-day before patches became available.
Evidence also suggests the group remained relatively quiet between February and July 2026 before launching the current wave of attacks.
Strategic Intelligence Collection Remains the Priority
Although the campaign targets a broad range of organizations, researchers believe intelligence gathering remains the primary objective.
Government agencies, defense-related organizations, critical infrastructure providers, telecommunications firms, and financial institutions continue to be among the most heavily targeted sectors.
The use of bland, informational email themes appears intentional, helping the messages blend naturally into everyday business communications while increasing the likelihood that recipients will open them without suspicion.
Conclusion
The OWAReaper campaign demonstrates a significant evolution in modern cyber espionage techniques. By exploiting a vulnerability in Microsoft Outlook Web Access, attackers can compromise users through nothing more than opening an email, establish persistence that survives credential resets and device rebuilds, and maintain long-term access to sensitive communications.
The campaign underscores a growing trend in advanced threat operations: moving away from traditional malware deployment in favor of stealthy browser-based implants that reside within cloud services and web applications themselves. For organizations relying on Microsoft Exchange and Outlook Web Access, patching vulnerable systems, auditing mailbox permissions, reviewing OAuth grants, and hunting for unusual browser-based activity should be considered immediate priorities.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
