Russian Hackers Exploit Exchange OWA Zero-Day 2026 for Long-Term Mailbox Access

You Patched Exchange, But Did You Kill the OWAReaper?

Here's the thing about XSS vulnerabilities: people often dismiss them. "Just XSS," they'll say, as if arbitrary JavaScript execution in a browser context isn't a critical problem. But when that XSS hits something like Microsoft Exchange OWA, and it's paired with a sophisticated implant designed for long-term persistence, "just XSS" becomes a serious headache. This is precisely the scenario unfolding with Laundry Bear's latest campaign, which exploits an Exchange OWA zero-day for persistent mailbox access.

Security professionals are rightly frustrated. We've seen this group before, and their tradecraft keeps evolving. The idea that merely opening an email can trigger a compromise, and then that compromise survives patching, password resets, and even re-imaging? That's the part that keeps you up at 2 AM.

How a 'Half-Click' XSS Opens the Door to Exchange OWA Zero-Day Exploits

The incident Proofpoint spotted around July 23, 2026, involves Laundry Bear (also known as Void Blizzard or TA488), a Russia-aligned espionage group. They're actively exploiting CVE-2026-42897, an Exchange OWA zero-day cross-site scripting flaw in on-premises Microsoft Exchange OWA.

This isn't some complex multi-stage attack requiring user interaction beyond the norm. It's a "half-click" exploit. All a target has to do is open a specially crafted email in a vulnerable OWA client. That's it. The XSS vulnerability, rooted in improper HTML sanitization, lets the attacker run arbitrary JavaScript right there in the victim's browser session.

The campaign infrastructure itself dates back to March 2026, well before Microsoft's advisory on May 14, 2026. This means Laundry Bear was using this as a zero-day for months. Their lures are deliberately unremarkable: supply-chain analyses, research updates, tourism metrics. They want you to open that email without a second thought.

Malicious email exploiting Exchange OWA zero-day for mailbox access — Malicious email exploiting Exchange OWA zero-day for mailbox

OWAReaper: The Exchange OWA Implant That Won't Die

Once that malicious email is opened, the embedded JavaScript loader kicks off. It pulls a Base64-encoded payload from a social media icon URL (after the '#' character) and deploys OWAReaper. This isn't a traditional file-on-disk malware. OWAReaper, deployed via the Exchange OWA zero-day, runs entirely within the OWA reading pane.

First, it cleans up after itself. The implant rewrites the original email on the Exchange server, stripping out the exploit code. It also disables OWA pop-ups and right-click functionality to keep the user from noticing anything amiss.

Then, it gets to work collecting data: the compromised account's email address, username, and Outlook settings. It even creates invisible Document Object Model (DOM) elements to capture browser autofilled credentials. This is an evolution of their previous ZimReaper malware, which targeted Zimbra servers with similar XSS tactics.

But the real problem, the part that makes this so insidious, is OWAReaper's persistence.

The Persistence Mechanisms: Why Patches Aren't Enough

This implant, leveraging the initial Exchange OWA zero-day compromise, uses multiple, overlapping methods to ensure long-term access, even after you think you've cleaned house:

OAuth Token Theft and Folder Permissions: OWAReaper checks for Outlook add-ins that have ReadWriteMailbox permissions. It then steals OAuth tokens using the GetClientAccessToken operation request. With these tokens, it calls UpdateFolder to grant the low-permission 'Default' user (a preset alias in Exchange) Owner-level permissions on every single mail folder. Think about that. This means any authenticated account within the organization can now access that mailbox.

This server-side permission grant survives credential rotation and even a full system reinstallation. You can change the password, re-image the machine, and the attacker still has a back door.
IndexedDB Cache Poisoning: The implant enables caching in OWA, then injects a malicious iframe into the HTML of messages stored in OWA's offline IndexedDB. If the victim opens a poisoned email from the cache, that iframe executes, re-infecting them.
Browser localStorage: OWAReaper also hides an encrypted copy of itself in the browser's localStorage, under a legitimate OWA settings key. This ensures it re-executes every time the victim opens a new OWA tab.

For command and control, OWAReaper is equally clever. It queries GitHub's Commit Search API every 24 hours for encrypted messages matching a specific format and including the target's email address. As a fallback, it parses inbound emails every five minutes, looking for specific {target_email_address}{space}{Base64text} structures in message bodies stored in IndexedDB.

Data exfiltration primarily happens over HTTPS, with AES-CTR encrypted URI paths, proxied through legitimate image content delivery network (CDN) domains. If that fails, it falls back to direct communication with the attacker's server, or even DNS exfiltration, where encrypted data is Base32 encoded into DNS packets. This is battle-tested tradecraft.

The Real Impact: Beyond the Initial Exchange OWA Zero-Day Breach

The targets of this Exchange OWA zero-day campaign are high-value: U.S. and European government entities, telecommunications, financial, hospitality, and aerospace sectors. This isn't about quick smash-and-grab operations. This is about long-term espionage, deep access to sensitive communications, and the ability to harvest credentials and 2FA codes over an extended period.

The practical impact: an attacker with this level of persistence can maintain access to critical mailboxes for months, potentially years, even as organizations go through their standard incident response playbooks. When you reset a password or re-image a machine, you expect the problem to be gone. OWAReaper ensures it isn't. This is why the security community is so concerned; it forces a re-evaluation of what "remediation" actually means for browser-context attacks in critical enterprise systems.

Data exfiltration after an Exchange OWA zero-day compromise

What We Need to Do Now to Combat Exchange OWA Zero-Day Persistence

Microsoft did release security updates addressing CVE-2026-42897, the underlying Exchange OWA zero-day. Applying those patches is non-negotiable. But as we've seen, patching the initial vulnerability doesn't necessarily remove the implant's persistence.

Proofpoint has published Indicators of Compromise (IoCs), including domains and specific HTML message body structures. You need to be hunting for these.

Beyond that, here's what you should be doing:

Revoke Exchange Web Services tokens: This is a critical step to break the OAuth token persistence chain.
Strip "Default user" folder grants: Audit and remove any Owner-level permissions granted to the 'Default' user on mail folders. This is a manual, but essential, cleanup.
Clear OWA's offline database and localStorage key: This addresses the browser-side persistence mechanisms.
Monitor OWA access and audit mailbox rules: Look for unusual access patterns or newly created forwarding rules that could indicate compromise.

This isn't just about patching a vulnerability. It's about understanding the full attack chain, especially the sophisticated persistence mechanisms that allow an attacker to survive your standard cleanup efforts. We need to stop underestimating XSS, especially when it's weaponized by groups like Laundry Bear to create an Exchange OWA zero-day threat. Assume compromise, and then work to truly eradicate it, not just patch the entry point.