The IT team that reset passwords and wiped the infected machine may not have solved the problem. On July 29, cybersecurity firm Proofpoint disclosed a previously unknown browser-based implant called OWAReaper, deployed by a Russian state-linked hacking group known as Laundry Bear against US and European government agencies and critical-sector organizations — and OWAReaper is specifically engineered to outlast every standard incident response measure an organization would typically deploy. When OWAReaper’s most dangerous persistence mechanism is in place, the implant lives on the Exchange server itself, not on the victim’s device. Changing passwords does not remove it. Wiping and re-imaging the machine does not remove it. Only a deliberate audit and correction of Exchange folder permissions does.
The campaign began July 22, 2026 — one day before an international joint advisory from the NSA, CISA, and allied agencies from the UK, Europe, Australia, and New Zealand warned the public that the same group was running a separate, simultaneous attack against Zimbra webmail servers. When that advisory published, Proofpoint knew it had observed the group pivot to an even more sophisticated campaign targeting Outlook Web Access, but had not had time to analyze it fully. Wednesday’s report is the rapid follow-up.
OWAReaper: Delivery That Requires No Click
OWAReaper is delivered by exploiting CVE-2026-42897, a cross-site scripting flaw in Outlook Web Access that Microsoft disclosed on May 14 and confirmed as already under active exploitation in the wild. The flaw allows an Exchange server to mishandle HTML embedded in an email message body. When a recipient opens the email in OWA, the server fails to sanitize attacker-controlled content, causing a malicious JavaScript payload to execute inside the victim’s authenticated browser session without any attachment, link, or further action from the user.
Proofpoint calls this a “half-click” exploit because opening the message is the entire attack surface. Security training — “don’t click suspicious links,” “don’t open unexpected attachments” — offers no protection here. The triggering action is routine mail reading.
Laundry Bear, which Proofpoint tracks as TA488 and which Microsoft calls Void Blizzard, used compromised accounts to send emails with deliberately boring subject lines: “Global Gas Markets: Flows, Capacity, and Price Differentials,” “Semiconductor Supply Chain Indicators: Capacity, Packaging, and Pricing,” “Public Health Surveillance: Wastewater, Flu, AMR.” The content was designed to be plausible enough to open and unremarkable enough to dismiss without reporting — no links, no attachments, nothing visibly suspicious.
The campaign targeted organizations in the US and European government, telecommunications, financial, hospitality, and aerospace sectors. Proofpoint noted that the volume and breadth of targeting was unusual for TA488, and suggested this may have been intentional — a high-volume approach designed to blend in with ordinary spam and avoid scrutiny.
What OWAReaper Does Once It Executes
Once the JavaScript payload executes inside a victim’s OWA session, OWAReaper begins systematically covering its tracks and establishing access it intends to keep.
Its first act is housekeeping: it uses Outlook’s own APIs to rewrite the triggering email on the Exchange server, removing the exploit content so it cannot be recovered by forensic investigators. It then disables OWA pop-ups and right-click menus while it runs. With that done, it harvests the target’s email address, username, and Outlook settings, and deploys invisible HTML input elements designed to capture the user’s saved OWA password as the browser’s autofill function fills them in.
The persistence architecture that follows is what makes OWAReaper different from nearly everything Proofpoint has previously documented in this attack category.
Layer one operates inside the browser’s localStorage. OWAReaper encrypts a copy of itself and a decryption wrapper, then stores both inside the PageDataPayload.OwaUserDefaultSettings key — a legitimate field that OWA’s own page-rendering sync process reads every time a user opens an OWA tab. The sync routine evaluates OwaFrontendSyncState, and because OWAReaper is stored there, OWA’s own startup behavior re-executes the implant invisibly every time the victim opens a browser tab to check email.
Layer two targets OWA’s offline message cache. OWAReaper injects a hidden iframe into messages stored in the browser’s IndexedDB offline database (owa_offline_db), enabling local caching of those poisoned messages. Each time the victim opens one of these cached emails, OWAReaper re-executes — including on a freshly re-imaged machine, because the offline cache can be repopulated from the Exchange server the next time the victim logs in.
Layer three is the one that defeats standard incident response, and the one that Proofpoint’s researchers flagged as the most dangerous. If the victim has any Outlook add-ins installed that carry ReadWriteMailbox permissions, OWAReaper uses those add-ins to call Exchange’s GetClientAccessToken endpoint and steal OAuth tokens. It then calls Exchange’s UpdateFolder API to grant Owner-level permissions on every mail folder to the Exchange tenant’s “Default” user — a low-permission preset alias present in every Microsoft Exchange deployment by default.
That grant gives any authenticated user in the same organization complete, persistent access to the compromised mailbox. It does not live in the browser. It does not live on the victim’s device. It lives on the Exchange server. As Proofpoint’s report states, “credential rotation and even full re-imaging of the targeted user’s device will not evict the actor.” Only deliberate, specific removal of the permission grant from Exchange itself closes this door.
Greg Lesnewich, one of the Proofpoint researchers who authored the report, described OWAReaper on social media as “one of the coolest implants we’ve ever examined.” The report itself calls it the most sophisticated backdoor the firm has observed delivered via a half-click exploit.
How OWAReaper Talks to Its Operators
OWAReaper communicates with Laundry Bear’s infrastructure through two distinct channels designed to give operators redundancy and make network detection harder.
For primary command and control, the implant queries GitHub’s public Commit Search API every 24 hours, looking for specially crafted commit messages in public repositories that contain the target’s email address. Those messages carry AES-CTR encrypted command data, decipherable only with a key hardcoded in the implant alongside a per-session key. The use of GitHub as a command-and-control channel means the traffic looks like ordinary calls to a major public developer platform.
Three command types are supported through this channel: replacing OWAReaper’s own code entirely, rotating the command-and-control domains it uses, or executing arbitrary JavaScript through eval(). The last type gives operators the ability to run any code they choose inside the victim’s authenticated OWA session without having to touch the device.
As a fallback, OWAReaper can also receive commands through inbound emails from Laundry Bear operators. The implant parses the same offline IndexedDB cache it uses for persistence, scanning for messages matching a specific structure that encodes commands in Base64. It polls this cache every five minutes for new instructions received in the last 30 minutes.
Two Ways Out — and Why Both Can Be Blocked
Data is exfiltrated primarily over HTTPS, with the traffic disguised as image requests by routing it through legitimate image content delivery networks — including Weserv.nl, WordPress’s image CDN at i3.wp.com, and Slack’s image CDN at slack-imgs.com. Those CDNs attempt to fetch a file from the attacker-controlled relay domain acocdn[.]com, which forwards the encrypted data onward. To an organization’s network monitoring tools, this traffic blends with ordinary web browsing.
When HTTPS exfiltration fails, OWAReaper falls back to DNS label tunneling. Stolen data is AES-CTR encrypted, then Base32-encoded using a restricted character set, split randomly into two to four substrings, and sent embedded in the subdomain fields of standard DNS address record queries to an attacker-controlled domain. DNS traffic crosses most enterprise firewalls without inspection, making this fallback channel difficult to block without disrupting legitimate operations.
Data exfiltrated includes OWA session blobs containing user identity and mailbox configuration, metadata about installed add-ins, and the output of any commands executed remotely.
A Campaign Two Months in the Making
The earliest infrastructure connected to the OWAReaper campaign was created in March 2026 — two full months before Microsoft disclosed CVE-2026-42897 and confirmed active exploitation on May 14. Microsoft delivered an out-of-band emergency mitigation in late May and a permanent patch on June 9, 2026. Proofpoint concludes it is “feasible” that Laundry Bear was using this vulnerability as a zero-day before anyone else knew it existed.
That pattern mirrors TA488’s Zimbra campaign, in which the group exploited CVE-2025-66376 as a zero-day for approximately four months before Zimbra patched it in November 2025. The group now has two documented instances of exploiting webmail cross-site scripting vulnerabilities before vendors were aware of them.
The lull in observed TA488 activity between February and July 22 may itself have been development time. Proofpoint observed no Laundry Bear activity during those months before the OWA campaign launched. The gap produced an implant meaningfully more capable than ZimReaper, the payload the group used against Zimbra. Unlike ZimReaper, OWAReaper does not perform mass exfiltration of email content — a deliberate choice Proofpoint attributes to improved operational security practices. ZimReaper stole 90 days of email history; OWAReaper steals credentials, session data, and configuration, and then waits for remotely executed commands.
Who Is Laundry Bear
The group behind OWAReaper was first publicly identified in May 2025 by the Dutch General Intelligence and Security Service (AIVD) and the Military Intelligence and Security Service (MIVD), who attributed a series of intrusions in the Netherlands — including a breach of the national police that exposed the contact details of every Dutch police officer — to the actor they named Laundry Bear.
Microsoft, which tracks the group as Void Blizzard, assessed it as Russian-state-affiliated with high confidence, and noted that its targeting priorities — government ministries, defense contractors, transportation, media, NGOs, and healthcare, concentrated in NATO member states and countries supporting Ukraine — are consistent with Russian intelligence collection objectives rather than financially motivated crime. MIVD Director Vice Admiral Peter Reesink stated the group was specifically targeting information about the purchase and production of military equipment by Western governments and weapons deliveries to Ukraine.
US prosecutors have linked the group to Yutek-NN, a Russian IT firm whose deputy director, Denis Obrezko, was arrested in Phuket, Thailand in November 2025 and indicted in Boston federal court. Yutek-NN held an FSB-issued license for surveillance-related technology. Obrezko has pleaded not guilty and is awaiting trial. The indictment identified at least 11 US companies as confirmed victims, a figure prosecutors described as likely a fraction of the total.
OWAReaper represents the group’s most significant capability upgrade since its public identification. The Zimbra campaign required the same type of webmail cross-site scripting exploit and the same half-click delivery technique, but ZimReaper operated at the browser level and was largely limited to credential and data theft. OWAReaper uses the same delivery mechanism to establish server-side access that survives the entire standard incident response lifecycle.
Does Patching CVE-2026-42897 Protect You?
The June 9 permanent patch for CVE-2026-42897 prevents OWAReaper from being newly delivered. But it does nothing for access that was already established before or after the patch was applied by an undetected OWAReaper infection. Any organization that ran on-premises Exchange with OWA accessible during the window from July 22 onward — particularly in the targeted sectors of government, telecom, finance, hospitality, and aerospace — should treat patching as a necessary but insufficient response.
The critical question is whether the server-side Exchange folder permissions were modified before the infection was discovered. If OWAReaper had time to run its third persistence layer — the UpdateFolder call granting the Default user Owner-level mailbox access — that access persists on Exchange infrastructure until explicitly revoked, regardless of what has happened to the endpoint.
What Organizations Should Do Now
Proofpoint recommends that affected organizations take the following specific remediation steps:
Audit Exchange Web Services token grants for installed Outlook add-ins. OWAReaper requires add-ins with ReadWriteMailbox permissions to steal the OAuth tokens it needs to call UpdateFolder. Revoking all such tokens and auditing which add-ins held them is a required step.
Review and audit Exchange folder permissions across the tenant — specifically checking for any Owner-level permission grants to the Exchange tenant’s “Default” user on any mail folder. Any such grant not established by a known administrator action should be treated as a potential OWAReaper artifact and removed.
Clear OWA’s offline database (owa_offline_db in IndexedDB) and the PageDataPayload.OwaUserDefaultSettings key in localStorage on any endpoint whose user may have opened OWA during the campaign window. Standard browser cache-clearing may not address these specific storage locations — they require targeted clearing.
Block outbound connections to the four known OWAReaper command-and-control domains: asecdns[.]com, acocdn[.]com, dnsrecursive[.]eu, and tdndns[.]com.
Monitor outbound traffic for patterns consistent with the OWAReaper exfiltration architecture: HTTPS requests routing through image CDN services (weserv.nl, i3.wp.com, slack-imgs.com) to unfamiliar downstream domains, and high volumes of DNS queries with unusually structured subdomain fields.
Additional remediation guidance is available on the Microsoft Exchange Team Blog.
Frequently Asked Questions
Does patching CVE-2026-42897 remove OWAReaper if my Exchange server was already infected?
No. The patch prevents new OWAReaper infections from being delivered — it addresses the cross-site scripting vulnerability in Outlook Web Access that the implant uses for initial delivery. But patching does nothing to remove access that OWAReaper has already established. The most dangerous element of OWAReaper is a server-side permission grant — a call to Exchange’s UpdateFolder API that gives the attacker’s infrastructure Owner-level access to the compromised mailbox through Exchange’s Default user alias. That access lives on Exchange infrastructure, not on the victim’s endpoint, and is not removed by patching, re-imaging, credential rotation, or any standard incident response measure. Only a deliberate audit and removal of that permission grant at the Exchange server level closes this access, as detailed in Proofpoint’s analysis.
Why can’t we just re-image the machine and reset the password?
Both are necessary but not sufficient if OWAReaper ran long enough to establish server-side persistence. Credential rotation addresses browser-captured passwords; it does not affect OAuth tokens already stolen and used to grant Exchange folder permissions. Re-imaging removes whatever was on the endpoint — but OWAReaper’s most durable mechanism was never on the endpoint to begin with. It granted itself Exchange-level folder access using the victim’s own privileges and then persisted that access on the server. What’s more, even the browser-based persistence layers can survive re-imaging: OWAReaper injects hidden iframes into OWA’s offline email cache, which can be repopulated from Exchange when the re-imaged machine reconnects, according to Proofpoint’s findings.
How does Laundry Bear use GitHub to send commands to OWAReaper?
OWAReaper queries GitHub’s public Commit Search API every 24 hours, searching for specially formatted commit messages that contain the target’s email address. Those messages carry AES-CTR encrypted command payloads, which only OWAReaper — with its hardcoded decryption key — can read. To everyone else, and to GitHub’s own systems, these look like ordinary public code commits. Three command types can be issued this way: replacing OWAReaper’s own code, rotating the command-and-control domains it uses, or running arbitrary JavaScript through eval() inside the victim’s live OWA session. Using a trusted, widely used developer platform as a command channel makes the traffic difficult to block without disrupting legitimate engineering workflows, as Proofpoint’s report explains.
My organization uses Exchange Online, not on-premises Exchange. Are we affected?
Exchange Online (Microsoft 365 hosted mail) is not affected by CVE-2026-42897. OWAReaper targets on-premises Exchange Server deployments where OWA is exposed — specifically Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition. If your organization has migrated entirely to Exchange Online / Microsoft 365 with no on-premises Exchange infrastructure, you are not in scope for this specific campaign. If your environment is a hybrid deployment with on-premises Exchange servers still active, those on-premises components require the same assessment as a fully on-premises organization.
Click Here For The Original Source.
