Laundry Bear Exploits OWA Vulnerability in Half-Click Phishing Campaign

In a critical cybersecurity advisory released by enterprise security researchers at Proofpoint, an active, highly sophisticated cyberespionage campaign conducted by the state-sponsored Russian threat actor Laundry Bear has been exposed. Tracked across the threat intelligence community under multiple designations—including TA488, Void Blizzard, CL-STA-1114, and UNK_PitStop—the group is actively weaponizing a high-severity cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA). Designated as CVE-2026-42897 with a Common Vulnerability Scoring System (CVSS) v3 score of 8.1, the vulnerability enables covert execution of malicious code within an authenticated webmail session. By adopting a stealthy “half-click” attack vector, Laundry Bear has successfully compromised government entities and strategic enterprise targets across North America and Europe, establishing persistent access that stubbornly survives standard identity mitigation tactics like credential resets and device re-imaging.

Anatomy of the “Half-Click” Weaponization: CVE-2026-42897

Traditional phishing campaigns rely on multi-stage interaction models: a target must be coaxed into clicking an external, suspicious hyperlink or executing a malicious file attachment. The campaign mounted by Laundry Bear bypasses these user-interaction hurdles through a zero-interaction or “half-click” execution architecture. In this paradigm, simply selecting, opening, or previewing an incoming email in a vulnerable instance of Outlook Web Access triggers the underlying cross-site scripting flaw automatically.

The technical mechanics behind CVE-2026-42897 involve improper input sanitization within Microsoft Exchange Server’s webmail rendering engine. When OWA processes incoming HTML-formatted email bodies, the threat actor’s payload circumvents security filters by embedding fragmented JavaScript payload blobs within innocuous HTML tags. Once rendering occurs inside the client’s browser pane, these payload blobs dynamically concatenate to assemble a fully functional JavaScript loader inside the authenticated DOM environment of the webmail interface.

To maximize victim engagement and minimize suspicion, the attackers employ carefully crafted, banal email lures. The subject lines and body text appear routine and unalarming—such as administrative notifications, generic corporate circulars, or routine operational updates. Because these messages contain no suspicious URLs, executable attachments, or obvious red flags, users routinely open or skim them without raising security alarms. Furthermore, the delivery infrastructure is engineered to blend seamlessly into clean network traffic. Laundry Bear dispatches these phishing lures from a combination of adversary-controlled Proton Mail accounts and previously compromised, legitimate corporate email accounts, effectively frustrating traditional email security gateways and domain-reputation filters.

Inside OWAReaper: The Custom Browser-Based Stealth Implant

The ultimate objective of the payload loader is the injection and execution of OWAReaper, a previously unknown, browser-native JavaScript backdoor purpose-built for deep, persistent exploitation within Outlook Web Access. Researchers at Proofpoint have highlighted OWAReaper as one of the most sophisticated webmail implants ever observed in active espionage operations. Its operational flow is divided into multi-stage operational phases designed for stealth, credential theft, and long-term persistence:

• Server-Side Exploit Self-Sanitization: Upon execution within the victim’s active browser session, OWAReaper immediately issues silent background API calls back to the Exchange server to rewrite the original incoming email’s HTML body. By erasing the exploit code from the server copy while leaving the email visible, OWAReaper leaves virtually no forensic footprint for post-incident log analysis or automated email scanners.
• Contextual Reconnaissance & DOM Manipulation: The implant gathers critical user telemetry, including the victim’s email address, username, active session tokens, and specific OWA configuration settings. To capture user credentials in real time, OWAReaper injects invisible DOM form fields into the webmail interface, silently recording keystrokes and authentication inputs during subsequent login events.
• Browser-Layer Persistence via Web Storage: To ensure survival across browser restarts, OWAReaper writes an encrypted copy of its core codebase and an associated decryption wrapper directly into the browser’s local web storage (localStorage). Whenever a user opens a new tab or refreshes their OWA portal, the webmail interface reads and executes the stored script automatically, re-instantiating the backdoor seamlessly.
• OAuth Token Harvesting & Add-in Exploitation: OWAReaper queries the local OWA environment for installed Microsoft Outlook add-ins configured with ReadWriteMailbox permissions. Upon identifying susceptible add-ins, the implant steals active OAuth access tokens, allowing the adversary to interact with underlying Microsoft Graph APIs independent of the user interface.
• Mailbox Folder Permission Hijacking: In its most evasive maneuver, OWAReaper modifies mailbox Access Control Lists (ACLs) directly on the Exchange server. The malware assigns Owner-level permissions to the “Default” user identity across every mail folder in the compromised account. This structural modification grants any authenticated user inside the organization—or an external account leveraging compromised internal credentials—full, unrestricted read and write access to the entire mailbox.

Evolution of Laundry Bear’s Cyberespionage Tradecraft

The emergence of the OWAReaper campaign marks a significant escalation in tradecraft for Laundry Bear. Historically, Russian state-linked cyberespionage collectives—including TA422 (Fancy Bear/APT28), TA473 (WinterVivern), and TA445 (Ghostwriter)—have relied heavily on webmail XSS flaws to conduct widespread intelligence gathering. However, Laundry Bear has refined these methodologies into an art form focused on structural persistence.

Prior to targeting Microsoft Exchange, Laundry Bear deployed a precursor implant known as ZimReaper against the Zimbra Collaboration Suite by exploiting CVE-2025-66376, an XSS vulnerability in Zimbra’s Classic UI. While ZimReaper successfully extracted up to 90 days of historical mailbox messages, contact lists, and attachments, its persistence mechanisms relied heavily on active web sessions. The pivot to Microsoft Exchange and the deployment of OWAReaper demonstrates a deliberate effort to overcome conventional incident response playbooks.

In standard security operations, containing a suspected email compromise involves a well-defined sequence: revoking active session tokens, forcing a global password reset, re-authenticating MFA tokens, and re-imaging the impacted endpoint device. However, because OWAReaper executes server-side ACL modifications and extracts elevated OAuth tokens, Laundry Bear retains persistent mailbox access even after security teams perform full credential rotations and re-image endpoint hardware. The adversary can simply log into another compromised account within the enterprise or use harvested OAuth tokens to read incoming and historical emails continuously without triggering password-mismatch alerts.

Impact, Target Profile, and Scope

The operational footprint of this campaign indicates an intentional shift from narrow, highly specific targeting to a broad intelligence-harvesting sweep across high-value enterprise sectors. Enterprise threat intelligence monitoring confirms active exploitation targeting strategic organizations across the globe. Key targeted sectors include:

1. Government Entities: Federal and regional government ministries in the United States and NATO-aligned European nations.
2. Telecommunications & Defense: Defense industrial base suppliers, telecommunications operators, and aerospace engineering firms involved in sensitive military supply chains.
3. Financial & Commercial Sector: Major financial institutions, global consultancy firms, and multinational hospitality chains.

By extracting up to 90 days of historical mailbox data alongside real-time monitoring of operational communications, Laundry Bear gains critical visibility into national security policy, defense procurement details, diplomatic correspondence, and proprietary corporate intelligence. Furthermore, access to internal corporate webmail enables the adversary to conduct secondary spear-phishing attacks from trusted internal accounts, escalating lateral movement across trusted partner networks.

Defensive Guidance and Mitigation Strategies

Defending against half-click webmail exploits requires a multi-layered security strategy that extends beyond standard perimeter firewalls and identity management controls. Security operations centers (SOCs) and system administrators must implement immediate technical remediation steps to defend against Laundry Bear activity:

1. Immediate Patch Deployment: Verify that all on-premises and hosted Microsoft Exchange Server instances are fully updated with Microsoft’s official security updates addressing CVE-2026-42897. Patching the Exchange rendering engine halts the primary payload loader execution.

2. Server-Side Mailbox ACL Auditing: Run automated PowerShell auditing scripts across all Exchange mailboxes to inspect folder permissions. Specifically search for instances where the “Default” or “Anonymous” user account has been granted elevated rights (such as Owner, Editor, or PublishingEditor) on mailbox root directories and subfolders.

3. Active Session Termination and Token Revocation: Revoke all active OAuth refresh tokens, app passwords, and webmail session cookies across the enterprise environment. Enforce mandatory re-authentication using FIDO2-compliant, hardware-bound phishing-resistant Multi-Factor Authentication (MFA).

4. Web Browser & Local Storage Remediation: Deploy endpoint management rules to audit and clear browser local storage (localStorage and sessionStorage) across enterprise endpoints to purge residual OWAReaper persistence scripts.

5. Web Application Layer Monitoring: Implement strict Content Security Policy (CSP) headers on Exchange web servers to restrict the execution of inline scripts and disallow dynamic script evaluation from untrusted sources. Monitor Web Application Firewall (WAF) logs for abnormal HTTP POST requests directed toward OWA endpoints originating from anonymous VPNs or Proton Mail referral traffic.

Conclusion

The campaign orchestrated by Laundry Bear using CVE-2026-42897 and the OWAReaper implant represents a profound shift in modern nation-state cyberespionage. By targeting the trust boundary between the user’s web browser and the authenticated webmail interface, threat actors can bypass multi-factor authentication, survive credential rotations, and operating undetected within enterprise environments. Cybersecurity defenders must adapt by implementing rigorous application patching, continuous mailbox permission auditing, and robust session-layer protections to safeguard strategic communications against these persistent threats.