Russian threat actors have been exploiting a vulnerability in Microsoft Outlook Web Access (OWA) to target various sectors, including government entities in the U.S. and Europe, as well as the telecommunications, financial, hospitality, and aerospace industries. This activity, which began on July 22, 2026, involves the exploitation of CVE-2026-42897, a cross-site scripting (XSS) vulnerability in OWA. Microsoft had previously identified this flaw as being actively exploited since May 2026.
Enterprise security firm Proofpoint has attributed these attacks to a group known as Laundry Bear, also referred to as CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard. This group was previously linked to the exploitation of CVE-2025-66376, an XSS vulnerability in Zimbra’s Classic UI, starting in July 2025. In those attacks, the threat actors sent emails from adversary-controlled Proton Mail accounts and compromised addresses, triggering exploits upon viewing the emails in vulnerable versions of Zimbra. This led to the deployment of a JavaScript payload named ZimReaper, capable of harvesting 90 days’ worth of the victim’s emails and other sensitive data.
In the current campaign, the attackers are employing similar tactics. They send emails from compromised accounts that exploit the OWA vulnerability. Notably, the volume and breadth of these phishing messages represent a significant shift from previous TA488 campaigns, suggesting an intentional effort to blend in with mass-mailing spam to evade detection.
The phishing emails are designed with vague content, requiring no action from the recipient. They often mimic informational messages on topics like supply chain analyses, research updates, and market metrics. This approach aims to lend an air of legitimacy to the emails, increasing the likelihood that recipients will open them, thereby triggering the exploit for CVE-2026-42897.
Upon opening the email, a JavaScript loader uses the onload event handler to parse the message body, assemble a Base64 fragment, and execute it as encoded JavaScript. The initial exploit trigger and relevant payloads are embedded within the social media icons in the email’s HTML. Subsequent payload data is stored after # symbols, which browsers typically ignore when parsing images from Base64.
This exploitation culminates in the deployment of a sophisticated JavaScript-based implant named OWAReaper. This malware is specifically designed for persistent access within Microsoft’s webmail client and represents an evolution of the previously used ZimReaper. Executed within the OWA reading pane, OWAReaper utilizes Outlook APIs to rewrite emails on the Exchange server, allowing the attackers to maintain access even after credential changes.
The use of ‘half-click’ exploits—where merely opening the email is sufficient to trigger the compromise—demonstrates a significant advancement in the threat actor’s capabilities. This method underscores the importance of robust email security measures and user awareness training to mitigate such sophisticated attacks.
Organizations are advised to apply the latest security patches promptly, implement multi-factor authentication, and educate employees about the risks associated with unsolicited emails. Monitoring for unusual email activity and conducting regular security audits can also help in early detection and prevention of such threats.
As cyber threats continue to evolve, staying informed about emerging vulnerabilities and attack vectors is crucial. The exploitation of OWA by Russian threat actors highlights the need for continuous vigilance and proactive security measures to protect sensitive information and maintain operational integrity.
