Russian state-aligned hackers are using OWAReaper malware and a Microsoft Exchange vulnerability to retain covert access to targeted mailboxes, Proofpoint reported on July 29. The campaign, attributed to the group tracked as TA488, Void Blizzard and Laundry Bear, targeted government entities in the United States and Europe alongside telecommunications, financial, hospitality and aerospace organizations.

Proofpoint said the campaign began on July 22 and abuses CVE-2026-42897, a cross-site scripting flaw in Outlook Web Access. Microsoft disclosed active exploitation and issued emergency mitigation guidance in May. Proofpoint assessed that infrastructure created in March makes earlier zero-day use feasible, but did not present that possibility as confirmed.

The attack arrives through crafted messages with routine subjects such as supply-chain research or market indicators and no suspicious link or attachment. When a recipient opens one in OWA, inadequate HTML sanitization lets embedded JavaScript assemble and execute a payload from encoded data in the message body. Proofpoint calls this a half-click exploit because opening the email can trigger compromise.

OWAReaper operates inside the browser reading pane, removes exploit content from the server copy and gathers account and Outlook configuration data. It can create invisible fields that capture credentials supplied by browser autofill. The implant also uses Outlook add-ins with ReadWriteMailbox permission to obtain OAuth tokens and can grant the Default user Owner-level access to mailbox folders, leaving server-side persistence that password rotation or device reimaging does not remove.

Proofpoint found two command channels: encrypted instructions in GitHub commit messages and specially structured inbound emails. Exfiltration can travel over HTTPS through image content delivery services or directly to actor infrastructure, with encrypted and Base32-encoded DNS queries as a fallback. The company published network domains, a SHA-256 hash for the malicious HTML body and detection rules for defenders.

Organizations running affected Exchange environments should apply Microsoft's current protection and review Proofpoint's remediation guidance. Recommended investigation steps include auditing and revoking Exchange Web Services tokens, removing improper Default-user folder permissions, clearing affected OWA browser storage and checking outbound traffic against the published indicators. Defenders should also examine bland, attachment-free email lures rather than relying only on link and file detection.