Russian hackers used an Outlook Web Access flaw to plant hidden backdoor in mailboxes
Proofpoint says Laundry Bear, tracked as TA488, exploited a zero-day in Microsoft's webmail to install OWAReaper, a stealthy tool that survives password resets.
Key points
- Proofpoint links the campaign to Laundry Bear, a Russian state-backed group also called Void Blizzard by Microsoft and tracked as TA488 by Proofpoint.
- The attackers used CVE-2026-42897, a flaw in Outlook Web Access that Microsoft patched on 14 May after finding it exploited as a zero-day.
- Targets included government bodies in the United States and Europe and firms in telecoms, finance, hospitality and aerospace.
- The backdoor, called OWAReaper, keeps access to victim mailboxes even after passwords are changed or computers are wiped.
- Infrastructure for the campaign was set up in March, roughly two months before Microsoft's public advisory.
A Russian government-linked hacking group has been reading targets' email through a flaw in Microsoft's web-based Outlook, according to a new report from security firm Proofpoint.
Proofpoint tracks the group as TA488. Microsoft calls it Void Blizzard. Dutch intelligence services named it Laundry Bear earlier this year. All three names point to the same crew, working in support of Russian state interests.
The campaign, first detailed by BleepingComputer, was spotted about a week ago.
How did the attack work?
Victims only had to open an email. No clicking, no attachments. Proofpoint calls this a "half-click exploit" because reading the message in the browser is enough to trigger the code.
The hackers abused CVE-2026-42897, a cross-site scripting bug in Outlook Web Access, which is the version of Outlook you use inside a web browser. Cross-site scripting means the server failed to clean up the HTML in a message, so hidden JavaScript code inside the email could run as if it were part of the trusted webmail page.
Proofpoint says the malicious code was hidden in the web addresses of social-media icons in the email footer, tucked after the '#' character where most people would never look.
The subject lines were dull on purpose: supply-chain reports, tourism figures, gas-market updates. Boring enough that a target would skim, shrug, and move on without reporting it.
What does OWAReaper actually do?
OWAReaper is the backdoor that gets planted. Proofpoint describes it as the most sophisticated tool of its kind they have seen delivered this way.
Once it runs inside the reading pane, it quietly rewrites the original email on the Exchange server to scrub out the exploit code, so investigators looking later find nothing unusual. It also switches off pop-ups and the right-click menu while it works.
It then grabs the account's email address, username and settings, and tries to steal saved passwords by planting invisible boxes on the page that the browser auto-fills.
Why can't victims just change their passwords?
Because the attackers give themselves permission at the server, not at the user's device. Resetting a password does not undo it.
OWAReaper looks for Outlook add-ins that already have mailbox access, steals their OAuth tokens (the digital passes that prove an app is allowed in), and then quietly grants "Owner" rights over every mail folder to a built-in low-level account called "Default" that exists in all Microsoft Exchange tenants.
After that, any authenticated user inside the organisation can read the victim's mailbox. Wiping the laptop does nothing. Rotating credentials does nothing. The permission sits on the Exchange server.
A second trick injects a hidden iframe into cached copies of messages stored offline, so the malware fires again every time the victim opens one of those emails.
Timeline and scope
| Date | Event |
|---|---|
| March | TA488 stands up attack infrastructure |
| 14 May | Microsoft publishes advisory for CVE-2026-42897 |
| Last week | Proofpoint spots active OWAReaper campaign |
| Earlier in 2025 | Same group used CVE-2025-66376 zero-day against Zimbra |
Proofpoint says OWAReaper is an evolution of ZimReaper, malware the same group used against Zimbra mail servers to steal emails, two-factor codes and passwords. The overlap in tradecraft is part of why the company attributes the new activity to TA488 with medium confidence.
The malware talks to its operators two ways: by reading encrypted commands hidden in public GitHub commit messages, and by parsing specially formatted emails delivered to the victim's inbox. Stolen data goes back out over HTTPS through image content delivery networks, with a DNS-based fallback if that fails.
What should organisations do?
Apply Microsoft's May patch for Outlook Web Access if you have not already. Audit mailbox folder permissions for unexpected "Owner" grants to the Default user. Review Outlook add-ins with ReadWriteMailbox rights and revoke any you do not recognise. Proofpoint has published indicators of compromise, including the domains and the HTML pattern used in the exploit emails.
