The Return of TA488: Persistent Attacks Against Outlook Web Access
Overview
A Russian-linked threat actor, tracked by Proofpoint as Laundry Bear and also known as CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard, has been observed exploiting CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Outlook Web Access. The campaign began on July 22, 2026 and targets U.S. and European government entities, along with organizations in telecommunications, finance, hospitality, and aerospace.
This activity represents an evolution of the same group's prior exploitation of CVE-2025-66376, an XSS flaw in Zimbra Classic UI that was used to deploy the JavaScript credential harvester known as ZimReaper. The newer campaign introduces OWAReaper, a more advanced implant delivered through a half-click exploitation technique.
Background
Traditional incident response procedures often rely on password rotation, session revocation, and endpoint re-imaging to remove attacker access. OWAReaper is designed to bypass these measures by establishing persistence within Microsoft Exchange infrastructure rather than relying only on the compromised endpoint.
OWAReaper can grant Owner-level permissions to attacker-controlled identities on Exchange mail folders. These server-side permissions can remain active after passwords are changed, sessions are revoked, or the affected workstation is re-imaged. Responders must identify and manually remove unauthorized mailbox and folder permissions from the Exchange environment.
The implant also creates a second persistence layer in OWA's offline IndexedDB email cache. If affected browser data is restored after re-imaging, a cached malicious message may execute the implant again.
Vulnerability Details
| CVE ID | CVSS Score | EPSS | CISA KEV | Affected Product | Vulnerability Type |
|---|---|---|---|---|---|
| CVE-2026-42897 | 8.1 (High) | 5.64% | Yes |
Microsoft OWA (Exchange Server 2016/2019) |
Cross-Site ScriptingCWE-79
|
Visual Attack Flow
Phishing Email Delivered
Proton Mail or a compromised account sends a message containing concealed Base64 image HTML.
CVE-2026-42897 Exploited
The OWA reading pane triggers the malicious JavaScript onload= handler.
OWAReaper Implant Deployed
The browser implant executes and rewrites the original email to remove visible exploit content.
Credential Harvesting
Saved OWA credentials are captured through browser autofill and localStorage persistence.
OAuth Token Theft
Outlook add-ins with ReadWriteMailbox permissions are abused to obtain OAuth tokens.
Owner-Level Mailbox Access
Unauthorized delegate permissions create persistent server-side access to Exchange mail folders.
Offline Cache Persistence
A hidden iframe is placed in OWA IndexedDB cache to restore execution from cached messages.
Command and Control
Commands are delivered through GitHub Commit Search or specially structured inbound emails.
Encrypted Data Exfiltration
Data leaves over AES-CTR protected HTTPS, with DNS tunneling available as a fallback.
Persistent Server-Side Access
Mailbox permissions remain active until they are manually removed from the Exchange server.
Attack Methodology
The attack chain is deliberately simple from the victim's perspective. Malicious emails are distributed from adversary-controlled Proton Mail accounts or previously compromised addresses. The messages imitate ordinary informational communications and contain no clear call to action.
By removing suspicious links and attachments, the attacker increases the likelihood that the recipient will open and read the message, which is enough to trigger the exploit in a vulnerable OWA environment.
Phase 1: Phishing Email Delivered
The victim receives a generic message containing Base64-encoded social media icon images. The exploit payload is embedded in the message HTML.
Phase 2: Half-Click Exploit Fires
Opening the email causes an onload= handler to parse encoded content and execute JavaScript within the OWA reading pane.
Phase 3: OWAReaper Implant Deployed
The implant is installed and uses Outlook APIs to rewrite the original email on the Exchange server, removing evidence of the exploit content.
Phase 4: Credential Harvesting and Browser Persistence
Hidden input elements attempt to collect saved OWA credentials through autofill. Encrypted implant data and a decryption wrapper are stored in browser localStorage.
Phase 5: Mailbox Permissions and OAuth Access
The implant checks for Outlook add-ins with ReadWriteMailbox access, steals OAuth tokens, and assigns unauthorized Owner-level mail folder permissions.
Phase 6: Offline Cache Persistence
A hidden iframe is placed inside messages stored in OWA's IndexedDB cache, allowing the implant to execute again when a malicious cached message is opened.
Indicators of Compromise
The following indicators have been associated with the reported OWAReaper campaign infrastructure:
| Type | Indicator | Description |
|---|---|---|
| C2 Server | 45.131.66[.]106 | Primary command-and-control or staging server |
| C2 Beacon | hxxp://45.131.66[.]106:4444/beacon | Reported beacon endpoint |
| Staging Server | 64.20.53[.]230 | Secondary staging infrastructure |
| C2 Channel | api.github.com/search/commits | GitHub Commit Search API used for command delivery |
| Delivery Method | Proton Mail accounts | Adversary-controlled sender accounts used for phishing |
MITRE ATT&CK Coverage
| Technique ID | Technique Name | Tactic |
|---|---|---|
| T1189 | Drive-by Compromise | Initial Access |
| T1059.007 | Command and Scripting Interpreter: JavaScript | Execution |
| T1539 | Steal Web Session Cookie | Credential Access |
| T1528 | Steal Application Access Token | Credential Access |
| T1098.002 | Account Manipulation: Additional Email Delegate Permissions | Persistence |
| T1176 | Browser Extensions | Persistence |
| T1041 | Exfiltration Over C2 Channel | Exfiltration |
| T1071.004 | Application Layer Protocol: DNS | Command and Control |
| T1102 | Web Service | Command and Control |
Mitigation & Recommended Actions
Organizations using Microsoft OWA and on-premises Exchange Server should prioritize the following actions:
Apply the Microsoft Security Update
Apply Microsoft's security update for CVE-2026-42897 immediately across affected Exchange Server environments. Verify successful deployment and confirm that no unsupported or unpatched Exchange systems remain exposed.
Audit Exchange Mailbox and Folder Permissions
Review mailbox delegates and folder-level permissions for unexpected Owner access. Remove unauthorized permissions directly from Exchange and investigate accounts that received access without an approved administrative change.
Revoke Suspicious OAuth Tokens and Add-in Access
Audit OAuth tokens and Outlook add-ins with ReadWriteMailbox permissions. Revoke unrecognized tokens and remove add-ins that are not explicitly approved.
Clear Browser Local Storage and IndexedDB
Clear browser localStorage, IndexedDB, and offline OWA cache data on affected systems. Do not restore cached browser data from backup until it has been reviewed for malicious messages or embedded iframe content.
Monitor for OWAReaper Network and Email Activity
Monitor for the reported infrastructure, unusual GitHub Commit Search API requests, suspicious Proton Mail delivery patterns, anomalous DNS labels, and unexpected encrypted outbound traffic from browser processes.
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.
It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.
Experience the fastest and most accurate patching software here.
