Russian state-sponsored hackers have been exploiting a previously unknown vulnerability in Microsoft Exchange’s Outlook Web Access (OWA) to gain long-term access to email accounts. The hacking group, known as Laundry Bear or Void Blizzard, has used this exploit to deliver a sophisticated backdoor called OWAReaper, which can collect sensitive information and maintain access to the compromised account even after system restoration or credential rotation.
The vulnerability, tracked as CVE-2026-42897, is a cross-site scripting (XSS) flaw that allows malicious code to be executed in the browser context when a user opens a specially crafted email in OWA. This type of exploit is known as a “half-click” attack, as it can be triggered simply by opening the email, without requiring any further interaction. The attackers have been targeting various organizations, including government entities and companies in the telecommunications, financial, hospitality, and aerospace sectors.
Laundry Bear’s latest campaign is notable not only for its sophistication but also for its ability to evade detection. According to researchers at Proofpoint, the threat actor was already exploiting this vulnerability as a zero-day when Microsoft released an advisory on May 14. The attackers had even set up their attack infrastructure in March, nearly two months before Microsoft’s warning.
The exploit works by taking advantage of improper HTML sanitization in OWA. When a malicious email is opened, it includes JavaScript code that adds HTML and JavaScript elements to the message body. This allows the attackers to include a Base64-encoded payload blob embedded in social media icon URLs after the ‘#’ character. The payload contains a JavaScript loader and the OWAReaper backdoor.
Once installed, OWAReaper uses Outlook APIs to rewrite the email on the Exchange server and remove the exploit content. It also disables pop-ups and right-click functionality while it runs. The malware collects sensitive information such as the compromised account’s email address, username, and Outlook settings, and attempts to steal access credentials by creating invisible elements in the Document Object Model (DOM) and waiting for the browser to automatically fill them in.
What sets OWAReaper apart is its long-term persistence mechanism. Even if a system is restored from a clean image or credentials are rotated, the attackers can maintain access to the compromised mailbox. This is achieved through OWAReaper’s ability to use Outlook add-ins with ReadWriteMailbox permissions to steal OAuth tokens and grant itself Owner-level permissions to the ‘Default’ user on every mail folder.
The implications of this exploit are significant. Organizations that have not patched their Exchange servers for CVE-2026-42897 are at risk of falling victim to Laundry Bear’s campaign. Even those who have patched may still be vulnerable if they have not implemented additional security measures, such as disabling OWA pop-ups and right-click functionality.
To protect themselves, users should exercise caution when opening emails, especially those with attachments or links from unknown senders. Organizations should also ensure that their Exchange servers are patched for CVE-2026-42897 and implement additional security measures to prevent similar exploits in the future.
Source: Bleeping Computer — 2026-07-29