A sophisticated JavaScript backdoor deployed via half-click exploits targeting Microsoft OWA, capable of persistent mailbox access, credential theft, and data exfiltration via HTTPS and DNS tunneling, surviving credential rotation and device re-imaging.