A half-click into the inbox
Proofpoint has detailed a campaign that should make anyone still running on-premises Exchange uncomfortable. The Russian state-sponsored group tracked as Laundry Bear, and elsewhere as Void Blizzard or TA488, is exploiting CVE-2026-42897, a cross-site scripting vulnerability in Outlook Web Access that stems from improper HTML sanitization in message bodies. The flaw carries a CVSS score of 8.1 and executes attacker-controlled JavaScript in the browser context the moment a victim opens a specially crafted email. Researchers describe it as a half-click exploit, because the user does not need to click a link or open an attachment. Rendering the message in the OWA client is enough to trigger code execution.
The timeline is the part that should sting. Microsoft published its advisory for CVE-2026-42897 on May 14, but Proofpoint found the group had stood up its attack infrastructure back in March, roughly two months before the vendor warning. In other words, this was live as a zero-day well before defenders had a CVE to track. For any organization that treats patch cadence as its primary control for Exchange, that gap is the whole story. The active campaign against real targets was running while the vulnerability was still invisible to every scanner and every KEV-driven remediation queue in the industry.
A backdoor built to outlast your response
The payload, named OWAReaper, is engineered for durability in a way that undermines the standard containment playbook. It steals email addresses, usernames, Outlook settings, and browser-autofilled credentials, and it modifies messages on the Exchange server itself to scrub traces of the exploit. More troubling for responders, it implements dual persistence, combining OAuth token theft with offline injection into the browser's local storage. That design lets it maintain access even after a victim rotates credentials or an IT team rebuilds the affected machine. If a poisoned email still sits in a cached mailbox, opening it can reinfect a freshly imaged host.
This changes the incident math. The instinctive response to a compromised endpoint, reimage the box and reset the passwords, is precisely what OWAReaper is built to defeat. Eradication now requires purging the malicious messages from the mailbox and invalidating stolen OAuth tokens server-side, not just cleaning the client. Teams that declare victory after a standard rebuild will hand persistence back to the attacker the next time a user checks old mail. We have seen mailbox-resident implants before, but tying persistence to both server-side tokens and offline browser storage raises the bar for what counts as a clean recovery.
Command and control hidden in plain sight
OWAReaper's communications are designed to blend into traffic that no perimeter tool will reasonably block. Its primary channel queries the GitHub Commit Search API for encrypted instructions matching a target's email address, so the malware pulls orders from commit messages on a service every developer network already trusts. When that path is unavailable, it falls back to parsing commands from specially formatted emails delivered directly to the compromised mailbox, and it exfiltrates data over HTTPS with AES encryption through content-delivery-network domains, with a Base32-encoded DNS channel as a last resort. Each layer is chosen because it looks like ordinary enterprise activity.
For defenders, this collapses the value of simple domain and IP blocklists. You cannot firewall GitHub without breaking engineering, and CDN-fronted HTTPS is the definition of normal outbound traffic. Detection has to move up the stack toward behavioral signals: an Exchange host querying the GitHub commit API, unexpected outbound DNS with high-entropy subdomains, or OWA sessions spawning script activity they never should. Organizations leaning entirely on network indicators to catch this campaign will find the indicators are all legitimate services. The tradecraft here is a reminder that living-off-trusted-infrastructure is now the default for capable state actors, not an advanced edge case.
Who is in the blast radius
Proofpoint reports the campaign has focused on government entities across the United States and Europe, alongside organizations in telecommunications, financial services, hospitality, and aerospace. That target set reads like a deliberate intelligence-collection portfolio rather than a smash-and-grab for ransom, which fits Laundry Bear's state-sponsored profile. The common thread across these victims is not an industry so much as an architecture: they are the organizations most likely to still operate on-premises Exchange for sovereignty, latency, or legacy integration reasons. Attackers are targeting the webmail tier precisely because that is where large, slow-moving enterprises remain exposed.
The reason this actor keeps winning is instructive. Days before the OWA campaign surfaced, the same group was tied to exploitation of a Zimbra XSS zero-day, CVE-2025-66376, delivering a related implant called ZimReaper that harvested email, two-factor codes, and passwords. The through-line is a deliberate specialization in browser-rendered webmail flaws, where a single crafted message reaches the target with no user decision required. If your organization runs any self-hosted mail platform with a web client, you are inside the category this group has chosen to master, regardless of which product you standardized on.
The on-prem Exchange reckoning
For CIOs, this campaign is another data point in a case that has been building for years. Self-hosted Exchange has become a recurring beachhead for state actors, and the operational burden of defending it now rivals the cost of the migration many teams have been deferring. The half-click nature of CVE-2026-42897 means user training offers almost no mitigation, and the zero-day window means patching alone cannot be your only line. When the exploit fires on message render and the backdoor survives reimaging, the residual risk of keeping Exchange on-premises is no longer a theoretical footnote in a risk register.
That does not make cloud migration a simple yes, and the sovereignty and compliance reasons many enterprises kept Exchange in-house have not evaporated. The honest framing for the board is that on-premises webmail now carries a maintenance and monitoring tax that most organizations systematically underfund. If you are keeping it, budget for the detection engineering, mailbox-level forensics, and rapid mitigation capability that a target of nation-state XSS campaigns actually requires. Continuing to run it on a patch-and-pray posture is the option that this disclosure should take off the table.
Concrete moves now
Apply Microsoft's fix for CVE-2026-42897 if you have not, then treat patching as the floor rather than the finish. Hunt retroactively, because infrastructure for this campaign existed since March and the exploit predates the advisory by weeks. Look for OWA processes making outbound calls to the GitHub commit API, anomalous high-entropy DNS queries, and OAuth token grants that do not match user behavior. Given the mailbox-resident persistence, scope any suspected compromise to the mailbox and token layer, not just the endpoint, and be prepared to force-invalidate tokens server-side rather than trusting a credential reset.
Longer term, use this to pressure-test the assumption baked into your architecture that keeping mail on-premises is the conservative, lower-risk choice. Enumerate every self-hosted web-facing mail surface, confirm you have the telemetry to detect behavioral compromise on each, and put a real number on what continuous defense of that tier costs versus migration. Laundry Bear has now shown, twice in short order, that browser-rendered webmail is where it prefers to operate. Deciding you are comfortable owning that risk is a legitimate position, but it should be a deliberate decision with funding attached, not an accident of inertia.
