Laundry Bear’s new Microsoft Exchange attack triggers on email open (CVE-2026-42897)
Russia-affiliated cyber espionage group Laundry Bear (aka Void Blizzard, aka TA488) is exploiting CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Exchange, to target US and European government entities and a variety of private sector organizations via email.
The warning comes from Proofpoint, who detected emails carrying the concealed exploit hitting inboxes.
“The subject lines and lures are banal, likely so the targeted user opens and skims the message, but dismisses the message as junk without reporting it, especially given that there are no suspicious URLs or attachments present,” the company said.
Subject lines of the exploit-laden emails (Source: Proofpoint)
Anatomy of the infection
The exploit, which affects the webmail interface for Exchange, “constructs” a JavaScript loader from payload blobs stored in the message body HTML.
The loader ultimately delivers OWAReaper, a backdoor that is executed in the reading pane of Outlook Web Access (OWA), the webmail interface for Exchange.
Once OWAReaper runs, it:
- Rewrites the original email on the server to erase the exploit code, and disables pop-ups and right-clicking while it runs.
- Gathers the target’s email address, username and Outlook settings, and tries to capture login credentials via invisible form fields.
- Writes an encrypted copy of itself and a decryption wrapper in the browser’s storage space that OWA automatically reads and runs at startup, so OWA relaunches the malware each time a new OWA tab is opened.
- Checks for installed Outlook add-ins with ReadWriteMailbox permissions and uses them steal OAuth tokens and grant itself Owner-level permissions to the “Default” user on every mail folder, thus granting full access to the mailbox to any authenticated user in the same organization.
“This is a key aspect of the infection chain; if TA488 has access to other accounts in the organization, the group maintains persistent access to the target’s mailbox,” Proofpoint warned.
“This persistent access lives on the server-side and requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user’s device will not evict the actor.”
Finally, it adds a hidden iframe to messages stored in OWA’s offline IndexedDB message cache and enables caching. This allows it to reinfect re-imaged hosts if the victim opens a poisoned email from the cache.
How to respond
OWAReaper is controlled and executes commands it either fetches from public GitHub commit messages or gets via inbound emails sent by the attacker. It can also steal data either via HTTPS or DNS exfiltration.
Proofpoint says that OWAReaper is an evolution of the ZimReaper payload, which was used in a 2025 campaign by the same threat actor that took advantage of an (at the time) unknown vulnerability in Zimbra mailservers. The two payloads share code, behavior, and similar error-handling and reporting mechanisms.
Microsoft warned about CVE-2026-42897 exploitation in May 2026, when it provided a temporary mitigation. It then provided a definitive fix in June 2026.
“The first infrastructure related to this campaign was created in March 2026, two months prior to Microsoft’s out-of-band patch for CVE-2026-42897; based on this timeline, it is feasible that TA488 used this vulnerability as a zero-day,” the researchers added.
All organizations are advised to patch CVE-2026-42897 and, if they suspect they might have been targeted in this campaign, they should use indicators of compromise to check.
If compromised, they should engage in a multi-step cleanup procedure that involves cleaning affected endpoints, the mail server itself, and revoking tokens.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!