Russian Hackers Exploit Microsoft OWA Flaw to Maintain Mailbox Access After Credential Rotation

Russian threat actors linked to the exploitation of a Zimbra vulnerability have been observed exploiting CVE-2026-42897, a cross-site scripting (XSS) flaw in Microsoft Outlook Web Access (OWA), to target U.S. and European government entities, as well as telecommunications, financial, hospitality, and aerospace sectors. The activity, beginning July 22, 2026, involves sending emails from adversary-controlled Proton Mail accounts and compromised addresses that trigger the exploit when viewed, deploying a JavaScript payload called OWAReaper.

Proofpoint attributes the campaign to the threat actor Laundry Bear (also known as CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard). The group previously exploited CVE-2025-66376, an XSS flaw in Zimbra’s Classic UI, to deploy the ZimReaper payload. OWAReaper is described as the most sophisticated backdoor delivered via half-click exploits, sharing code with ZimReaper but specifically designed for persistent access within Microsoft’s webmail client.

Once executed within the OWA reading pane, OWAReaper uses Outlook APIs to remove exploit content from the email on the Exchange server, disables OWA pop-ups and right-click functionality, and captures saved credentials via browser autofill. It writes an encrypted version of itself to localStorage for automatic execution on every OWA tab opening. The malware checks for installed Outlook add-ins with ReadWriteMailbox permissions to steal OAuth tokens and grants itself Owner-level permissions on every mail folder, providing complete mailbox access to any authenticated user in the same organization.

OWAReaper employs two command-and-control methods: querying GitHub’s Commit Search API every 24 hours for commit messages containing the target’s email address, and parsing inbound emails from operators. Data exfiltration occurs over HTTPS with AES-CTR encrypted URI paths or via DNS label tunneling. The malware can survive browser reboots, credential rotation, and full device re-imaging, requiring deliberate removal from the Exchange server.