Summary
- Proofpoint says TA488, also tracked as Laundry Bear and Void Blizzard, used CVE-2026-42897 against Outlook Web Access from 22 July 2026.
- The campaign targeted European and US government entities, as well as telecoms, finance, hospitality, and aerospace organisations.
- OWAReaper’s persistence mechanisms raise recovery concerns because credential rotation and endpoint reimaging may not fully remove mailbox access.
Proofpoint has warned that TA488, the Russian-aligned group also tracked as Laundry Bear and Void Blizzard, used a half-click exploit against Microsoft Outlook Web Access in a campaign targeting European government and strategic-sector organisations.
The campaign began on 22 July 2026 and abused CVE-2026-42897, a cross-site scripting vulnerability in Outlook Web Access. Proofpoint said the activity targeted government entities in Europe and the US, alongside organisations in telecommunications, finance, hospitality, and aerospace. The group’s known focus on email and credential theft gives the campaign a clear espionage profile.
The infection path requires little interaction from the victim. Opening a crafted message in Outlook Webmail can be enough for a vulnerable Exchange server to process malicious HTML and execute JavaScript in the reading pane. Proofpoint calls the resulting browser-based implant OWAReaper.
Unlike conventional endpoint malware, OWAReaper runs inside the Outlook Web Access session and uses webmail functions to hide and persist. Proofpoint said it can rewrite the original message to remove exploit content, collect mailbox and user settings, attempt to harvest saved credentials through invisible input fields, and maintain access through OWA settings and offline browser storage.
That design complicates recovery. A device reimage, password reset, or browser restart may not be enough if malicious mailbox state, tokens, permissions, or local browser storage remain in place. Email systems are also deeply connected to password resets, supplier communications, approvals, legal correspondence, and executive communications, so mailbox persistence can support follow-on compromise even after the original message has disappeared.
Proofpoint’s recommended response includes reviewing Exchange Web Services tokens for affected add-ins, checking folder permission grants to the Default user, clearing OWA IndexedDB and localStorage keys on affected endpoints, and blocking or alerting on listed command and control servers. Organisations also need to follow Microsoft’s Exchange mitigation and patching guidance for affected deployments.
The campaign fits a wider pattern of attacks on public-facing webmail platforms, including Zimbra, Roundcube, SOGo, and Outlook Web Access. These systems carry valuable communications while often sitting close to authentication material and browser session state. Where logging is incomplete or retention is limited, a mailbox compromise can be difficult to reconstruct with confidence.
European government bodies, telecoms operators, aerospace businesses, and financial organisations should treat webmail compromise as an identity and communications incident, not only an email security event. Recovery work needs to include mailbox permissions, server-side settings, OAuth tokens, browser storage, and forensic review of message access after the initial lure was received.
