What happened
On July 29, 2026, Proofpoint reported that TA488 began a new exploitation wave on July 22, 2026, targeting US and European government bodies and organisations in telecommunications, finance, hospitality and aerospace. The campaign exploits CVE-2026-42897, an Outlook Web Access cross-site-scripting vulnerability Microsoft addressed in May 2026. Opening a crafted message in vulnerable OWA causes server-mishandled HTML to execute JavaScript in the reading pane; no link or attachment click is required. Attribution posture: Proofpoint attributes the OWAReaper activity to TA488, also tracked as Void Blizzard and Laundry Bear.
The JavaScript implant, OWAReaper, rewrites the malicious message, stores an encrypted copy under PageDataPayload.OwaUserDefaultSettings in localStorage and poisons OWA’s owa_offline_db IndexedDB cache. It can use add-ins with ReadWriteMailbox permission to call GetClientAccessToken, steal OAuth tokens and invoke UpdateFolder to grant the Default user Owner-level access to every mail folder. Proofpoint says this server-side permission can preserve mailbox access after password rotation or complete endpoint re-imaging.
Published indicators are asecdns[.]com, acocdn[.]com, dnsrecursive[.]eu and tdndns[.]com, plus SHA-256 6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4 for an HTML message body containing the exploit and payload. OWAReaper may exfiltrate ews_extensions_debug.json, msanalytics.json, cmnd_[HASH]_[FILENAME] and poison_wizard_error_dom.html. No attacker IP addresses were published.
Why this matters now
The new finding changes recovery scope. A team that patches Exchange, resets a password and rebuilds the user’s workstation may leave the adversary’s mailbox permissions, stolen tokens and OWA storage intact. The implant also runs inside the browser context without a conventional host executable, reducing the value of endpoint-only searching.
Organisations in targeted sectors should prioritise high-value mailboxes, OWA users and add-ins with ReadWriteMailbox permission. The use of bland informational lures means absence of suspicious links or attachments is not exculpatory. Mail stores, browser artefacts, Exchange permissions, OAuth issuance and outbound web and DNS telemetry must be examined together.
The decision for security leaders
Direct the messaging team to confirm Microsoft’s protection across every on-premises Exchange server, including systems receiving extended support. Then assign incident response to search historical email bodies for the published hash, inspect the four domains and review OWA browser storage on suspected endpoints.
Require Exchange administrators to audit folder permissions granted to Default and identity teams to revoke suspect EWS or add-in tokens. Recovery should be validated from a separate authenticated account, because the described persistence grants access to any authenticated user within the organisation when the permission change succeeds.
Evidence of closure
- Exchange records prove Microsoft’s protection is active on every relevant server.
- Mailbox audits show no unauthorised Owner permission for the Default user.
- EWS token records show suspect tokens were revoked and reissued.
- Endpoint validation confirms malicious OWA localStorage and IndexedDB entries are absent.
The Security.io assessment
Proofpoint provides detailed technical evidence, exact indicators and a coherent persistence chain. Its actor attribution is a research assessment supported by behavioural overlap; it should not be represented as an independent Security.io attribution. Government reporting separately links Laundry Bear to Russian state-supported espionage, but the new OWA campaign’s evidence comes from Proofpoint.
The highest-value control is not merely blocking domains. The decisive test is whether unauthorised server-side mailbox permissions, OAuth material or OWA storage remain. Organisations that cannot centrally inspect those elements have an email-recovery visibility gap requiring executive ownership.
Questions for the morning meeting
- Are any supported or legacy on-premises Exchange servers still exposing OWA?
- Can responders audit mailbox permissions and EWS tokens at enterprise scale?
- Does the recovery playbook address server-side and browser-side persistence?
- Which high-value mailboxes match Proofpoint’s targeted sectors and lure themes?