The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper.
Email security company Proofpoint spotted the activity a week ago targeting various organizations, including government entities in the U.S. and Europe, and companies in the telecommunications, financial, hospitality, and aerospace sectors.
Laundry Bear exploited CVE-2026-42897, a cross-site scripting (XSS) vulnerability that allows executing arbitrary JavaScript in the browser context when users open a specially crafted email in the Outlook Web Access (OWA) app.
Previously, the same hackers leveraged another XSS vulnerability (CVE-2025-66376) as a zero-day in Zimbra email servers to deliver malware ZimReaper that steals email communication, two-factor authentication (2FA) codes, application passcodes, and passwords.
Proofpoint researchers refer to this sort of XSS activity on webmail platforms as a “half-click exploit” because users only need to open the malicious email to trigger the exploited vulnerability.
Improper HTML sanitization
In a new report today, Proofpoint describes Laundry Bear’s new half-click exploit campaign as a significant “improvement in the group’s tradecraft and capability.”
Based on Microsoft’s advisory on May 14 for the CVE-2026-42897 flaw in OWA, the threat actor was already exploiting it as a zero-day.
The security issue causes the server to improperly sanitize the HTML code in the message body, which could be leveraged to run JavaScript when opening the email.
According to Proofpoint, Laundry Bear, which the company tracks as TA488, had created the attack infrastructure for the OWAReaper campaign in March, almost two months before Microsoft’s warning.
In the latest observed activity, the threat actor used messages on topics of interest to the target, such as supply-chain analyses, research updates, and performance indicators for tourism and gas markets.
“The subject lines and lures are banal, likely so the targeted user opens and skims the message, but dismisses the message as junk without reporting it, especially given that there are no suspicious URLs or attachments present.”
Proofpoint explains that the attacker leverages the improper sanitization issue to include malicious code in the messages to add HTML and JavaScript in the malicious messages.
Emails contained a JavaScript loader and Base64-encoded payload blobs embedded in social media icon URLs after the ‘#’ character.
The exploit delivers a backdoor that researchers call OWAReaper and describe as “the most sophisticated backdoor delivered via half-click exploits” they saw.
Analysis revealed a “suite of subtle persistence mechanisms” and revealed it to be an evolution of the ZimReaper malware observed in the attacks against Zimbra email servers.
“OWAReaper is executed entirely in the Outlook Web Access (OWA) reading pane. Upon execution, it uses Outlook APIs to rewrite the email on the Exchange server and remove the exploit content. Simultaneously, it disables OWA pop-ups and right-click ability while it runs,” Proofpoint says.
The malware collects the compromised account’s email address, username, and Outlook settings. It also tries to steal the access credentials by creating invisible elements in the Document Object Model (DOM) and waiting for the browser to automatically fill them in.
Long-term persistence mechanism
Proofpoint researchers discovered that TA488 (Laundry Bear, Void Blizzard) can maintain access to a target’s mailbox even if their system is restored from a clean image or credentials are rotated.
The threat actor achieves this through OWAReaper, which checks for installed Outlook add-ins that have ReadWriteMailbox permissions and uses them to steal OAuth tokens through the GetClientAccessToken operation request.
“It then calls UpdateFolder to grant itself Owner-level permissions to the 'Default’ user (a low-permission preset alias in all Microsoft Exchange tenants) on every mail folder,” the researchers explain.
This allows attackers to access the mailbox from any authenticated account within the organization.
Because mailbox permissions are configured on the server side, changing the compromised user's credentials or reinstalling the affected system does not revoke the attackers' access.
OWAReaper implements a second persistence mechanism by enabling caching and injecting a malicious iframe in the HTML of messages stored in OWA's offline IndexedDB.
“This iframe executes every time the victim opens a poisoned email from the cache,” the researchers say.
Two of everything
The malware supports two command-and-control (C2) mechanisms for receiving instructions from the attacker. One of them uses GitHub commit messages as the communication channel.
Every 24 hours, the malware queries GitHub's Commit Search API for encrypted messages that match a specific format and include the target's email address.
OWAReaper can also parse emails delivered to the target’s mailbox. It checks the IndexedDB for message bodies with the {target_email_address}{space}{Base64text}
structure.
Laundry Bear also used two methods to exfiltrate data, the main one using HTTPS with AES-CTR encrypted URI paths that would be proxied through certain image content delivery network (CDN) domains.
If the primary method fails, the data is delivered directly to the attacker’s server, which is defined in the function that initializes outbound network sessions.
There is also a DNS exfiltration fallback, where data is encrypted, then encoded in packets using the Base32 method.
Proofpoint attributed the OWAReaper campaign to the TA488 threat actor based on behavioral overlaps with the ZimReaper activity and the use of half-click XSS exploits to target webmail viewers for espionage purposes.
The researchers published a small set of indicators of compromise (IoCs) that includes the domains used and the HTML message body with the CVE-2026-42897 exploit and the OWAReaper payload.
Test every layer before attackers do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Get the whitepaper
Post a Comment Community Rules
You need to login in order to post a comment
Not a member yet? Register Now