Russian Laundry Bear Hackers Exploit Outlook Web Access Flaw

Russian state-linked hackers are exploiting a Microsoft Outlook Web Access vulnerability to deploy a sophisticated browser-based backdoor that can maintain access to compromised mailboxes even after passwords are changed.

The threat actor, tracked as Laundry Bear, Void Blizzard and TA488, is abusing CVE-2026-42897, a cross-site scripting vulnerability affecting Outlook Web Access in on-premises Microsoft Exchange environments.

Proofpoint said the latest campaign began on July 22, 2026, targeting government organisations in the United States and Europe, along with companies in the telecommunications, financial, hospitality and aerospace sectors.

Malicious emails require only a “half-click”

The attack begins with compromised email accounts sending deliberately ordinary-looking messages about topics such as supply chains, tourism, energy markets and public health.

The emails do not contain suspicious attachments or links. Instead, the vulnerability is triggered when a target opens the message inside Outlook Web Access.

CVE-2026-42897 allows improperly sanitised HTML inside the email body to execute arbitrary JavaScript within the victim’s authenticated OWA browser session.

Proofpoint calls this a “half-click” exploit because opening and viewing the email is enough to start the infection chain.

OWAReaper creates persistent mailbox access

The exploit deploys a previously undocumented JavaScript implant named OWAReaper, which runs entirely inside the Outlook Web Access reading pane without installing traditional malware on the endpoint.

Once executed, OWAReaper collects the user’s email address, username and Outlook configuration. It can also create invisible browser elements designed to capture credentials entered by password autofill.

The malware then checks for Outlook add-ins with ReadWriteMailbox permissions and attempts to obtain OAuth access tokens through Exchange APIs.

It also modifies mailbox-folder permissions to grant owner-level access to the Exchange “Default” user. This could allow an attacker controlling another authenticated account in the same organisation to continue accessing the victim’s mailbox.

Because these permissions are stored on the Exchange server, simply resetting the victim’s password or rebuilding the affected computer may not remove the attacker.

OWAReaper also stores an encrypted copy of itself in browser storage and can inject a hidden iframe into messages cached by OWA, allowing the implant to execute again when a poisoned message is opened.

GitHub and email used for attacker commands

OWAReaper supports two command-and-control methods.

One technique searches public GitHub commit messages for encrypted instructions associated with the victim’s email address. The second allows attackers to send commands through specially formatted messages delivered directly to the compromised mailbox.

The malware can exfiltrate information through HTTPS connections disguised as image requests. If that channel fails, it can use DNS tunnelling as a backup method.

Campaign may have started before Microsoft’s disclosure

Microsoft disclosed CVE-2026-42897 in May 2026 and released security protections for affected Exchange Server environments.

However, Proofpoint found that infrastructure connected to the OWAReaper campaign had been created as early as March 2026. Researchers said this makes it possible that Laundry Bear had access to the vulnerability before it was publicly disclosed, although this has not been conclusively confirmed.

Organisations operating on-premises Exchange Server should ensure Microsoft’s updates and mitigations have been applied.

Proofpoint also recommends auditing Exchange Web Services tokens, reviewing mailbox-folder permissions granted to the Default user, clearing affected OWA browser storage and investigating connections to the campaign’s known command-and-control infrastructure.