A newly uncovered cyber-espionage campaign has revealed that the Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting a critical Microsoft Exchange Outlook Web Access (OWA) vulnerability to deploy a powerful new backdoor called OWAReaper.
Security researchers at Proofpoint discovered the campaign targeting government agencies across the United States and Europe, along with organizations in the telecommunications, financial, hospitality, and aerospace industries. The attackers are exploiting CVE-2026-42897, a cross-site scripting (XSS) vulnerability that allows malicious JavaScript to execute when a victim simply opens a specially crafted email in Outlook Web Access.
Proofpoint describes the attack as a “half-click exploit” because users do not need to click links or download attachments. Simply opening the malicious email in OWA is enough to trigger the exploit, making the attack particularly difficult to detect.
The vulnerability stems from improper HTML sanitization in Outlook Web Access, allowing attackers to inject malicious HTML and JavaScript directly into email messages. According to Microsoft, the flaw was already being exploited as a zero-day before it was publicly disclosed. Proofpoint says the attackers had prepared the campaign infrastructure nearly two months before Microsoft’s security advisory was released.
To increase the chances of success, Laundry Bear disguised the malicious emails as routine business communications discussing supply chains, research reports, tourism performance, and gas market updates. Because the messages contain no suspicious attachments or URLs, victims are more likely to open and quickly dismiss them without realizing they have been compromised.
Once the exploit runs, it installs a sophisticated backdoor dubbed OWAReaper, which operates entirely inside Outlook Web Access. The malware immediately removes the exploit code from the compromised email stored on the Exchange server while disabling pop-ups and right-click functionality to reduce the chance of detection.
OWAReaper collects sensitive information from the victim’s account, including email addresses, usernames, and Outlook configuration settings. It also attempts to steal login credentials by creating hidden form elements that wait for browsers to automatically fill in saved usernames and passwords.
Researchers say one of the malware’s most dangerous capabilities is its ability to maintain long-term access to compromised mailboxes. Instead of relying solely on stolen passwords, OWAReaper searches for Outlook add-ins with ReadWriteMailbox permissions and abuses them to steal OAuth access tokens. It then modifies mailbox permissions to grant owner-level access to the Exchange tenant’s default user across every mail folder.
Because these permissions are stored on the Exchange server, attackers can continue accessing the mailbox even after passwords are changed or infected computers are completely reinstalled. The malware also creates a second persistence mechanism by injecting malicious code into Outlook Web Access’s offline cache, causing the payload to execute again whenever poisoned emails are reopened.
Proofpoint found that OWAReaper supports multiple command-and-control methods. One communication channel retrieves encrypted instructions hidden inside GitHub commit messages using GitHub’s Commit Search API. Another allows the malware to receive commands through specially formatted emails delivered directly to the victim’s mailbox.
The attackers also implemented multiple methods for stealing data. The primary technique sends encrypted information over HTTPS through image content delivery network (CDN) domains to blend with legitimate traffic. If that method fails, the malware can communicate directly with attacker-controlled servers or fall back to DNS-based data exfiltration using Base32-encoded encrypted packets.
Researchers linked the campaign to Laundry Bear based on similarities with the group’s earlier attacks exploiting a Zimbra zero-day vulnerability to deploy ZimReaper, another espionage-focused malware family designed to steal emails, two-factor authentication codes, passwords, and application credentials.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Proofpoint has released indicators of compromise, including malicious domains and samples of the HTML exploit used to deliver OWAReaper, enabling defenders to detect and investigate potential intrusions. The campaign highlights the growing sophistication of state-sponsored email attacks, where simply opening an email can be enough to compromise an organization.
