Opening the Email Was Enough. OWAReaper Stayed After the Password Changed.
A Russia-aligned espionage group turned an Outlook Web Access vulnerability into a browser-resident implant that could retain mailbox access after passwords were changed and an endpoint was rebuilt. The victim did not need to follow a link or open an attachment. Opening the email in OWA was enough.
Proofpoint reported on 29 July 2026 that TA488, also tracked as Void Blizzard and Laundry Bear, had begun exploiting CVE-2026-42897 on 22 July. The campaign targeted US and European government bodies and organisations in telecommunications, finance, hospitality and aerospace.
The script runs inside an authenticated mail session
CVE-2026-42897 is a cross-site scripting flaw in on-premises Microsoft Exchange Server Outlook Web Access. When a user opens a specially crafted message in vulnerable OWA, Exchange mishandles HTML from the email and the browser executes attacker-controlled JavaScript inside the user’s authenticated mail context.
This is not an unauthenticated server-side remote-code-execution vulnerability. It is also not zero-click: the message must be opened in OWA. Proofpoint calls the pattern a “half-click” exploit because the normal act of reading a message triggers the payload without a second click on a link or attachment.
Microsoft disclosed the vulnerability on 14 May and said it was already being exploited. CISA added it to the Known Exploited Vulnerabilities catalogue the following day. Microsoft first distributed an emergency IIS mitigation, then shipped Exchange security updates in June and July. Exchange Online was not affected.
OWAReaper is a browser implant with server-side consequences
The new payload, which Proofpoint named OWAReaper, runs in the OWA browser context and leaves no conventional executable on the host. The implant stores encrypted material in OWA localStorage and poisons the browser’s OWA IndexedDB cache so it can re-establish itself after the browser restarts.
Its reach does not stop at browser storage. Proofpoint found that OWAReaper could abuse add-ins with ReadWriteMailbox permission to obtain Exchange Web Services access tokens. It could then modify mailbox-folder permissions and grant the Default user owner-level access. That server-side permission can remain even if the victim changes a password or completely re-images the endpoint.
The distinction matters for incident response. OWAReaper does not survive because malicious code is hidden on a rebuilt Windows device. It survives because browser state, OAuth material and Exchange mailbox permissions are separate recovery layers. Rebuilding the endpoint addresses only one of them.
TA488 moved the same trust-boundary idea from Zimbra to Exchange
Proofpoint previously observed TA488 exploiting an XSS vulnerability in Zimbra to deploy a related browser implant. The Exchange campaign shows that the actor is not committed to one product. It is committed to a reusable operational concept: make the webmail application execute inside an already authenticated session, then convert that temporary browser position into durable access to the mailbox.
Proofpoint said the earliest infrastructure associated with the campaign was created in March, two months before Microsoft’s public disclosure. It assessed that zero-day use was feasible, but did not claim definitive proof that TA488 exploited the flaw before 14 May.
Patch, then hunt beyond the endpoint
- Install the July 2026 Exchange security update or a later supported update on every on-premises Exchange server and management-tools workstation.
- For Exchange 2016 and 2019, confirm eligibility for Microsoft’s Period 2 Extended Security Update programme or migrate to Exchange Server Subscription Edition.
- Audit Exchange folder permissions for unexpected grants to the Default user, especially owner-level access.
- Revoke and review Exchange Web Services tokens issued through affected OWA add-ins.
- Preserve evidence, then clear the OWA IndexedDB database and the PageDataPayload.OwaUserDefaultSettings localStorage key on affected endpoints.
- Search mail, DNS and proxy telemetry for Proofpoint’s published message hash, domains and ET detection signatures.
A password reset is not a complete mailbox-recovery plan. When malicious JavaScript can operate in the browser, obtain service tokens and alter server-side permissions, defenders must inspect every layer that can preserve trust.
Sources: Proofpoint Threat Research (29 July 2026; no publication time provided), Microsoft Exchange Team advisory (14 May 2026 at 20:14 UTC), and Microsoft July security-update guidance (14 July 2026; no publication time provided).
