Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation
Summary: Proofpoint attributed a campaign beginning July 22, 2026 to Laundry Bear (TA488), which exploited CVE-2026-42897, a cross-site scripting flaw in Microsoft Outlook Web Access rated CVSS 8.1, against U.S. and European government entities and the telecommunications, financial, hospitality, and aerospace sectors. The emails carried no URLs or attachments and triggered on opening, delivering a JavaScript implant called OWAReaper that rewrites the message on the Exchange server, captures OWA saved credentials through browser autofill, and stores an encrypted copy of itself in browser localStorage.
Key Takeaway: Proofpoint found OWAReaper's access lives server-side and requires deliberate removal from the Exchange server, so credential rotation and full re-imaging of the victim's device will not evict the actor. The earliest infrastructure in the campaign was created in March 2026, two months before Microsoft disclosed the flaw, raising the possibility it was used as a zero-day.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-66376CVE-2026-42897
- Related
- CVE-2026-42897: Microsoft Exchange Server Cross-Site Scripting Vulnerability Known Exploited Vulnerabilities · May 15, 2026CVE-2025-66376: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Known Exploited Vulnerabilities · Mar 18, 2026