Russian hackers used an Outlook Web Access flaw to plant hidden backdoor in mailboxes
Proofpoint says Laundry Bear, tracked as TA488, exploited a zero-day in Microsoft's webmail to install OWAReaper, a stealthy tool that survives password resets and credential rotations.
Key points
- Proofpoint links the campaign to Laundry Bear, a Russian state-backed group also called Void Blizzard by Microsoft and tracked as TA488 by Proofpoint.
- The attackers used CVE-2026-42897, a flaw in Outlook Web Access that Microsoft patched on 14 May after finding it exploited as a zero-day.
- Targets included government bodies in the United States and Europe, and firms in telecoms, finance and aerospace.
- OWAReaper keeps access to victim mailboxes even after passwords are changed or computers are wiped.
- Attack infrastructure was built in March, roughly two months before Microsoft's public advisory.
A Russian government-linked hacking group has been reading targets' email through a flaw in Microsoft's web-based Outlook, according to a new report from security firm Proofpoint.
Proofpoint tracks the group as TA488. Microsoft calls it Void Blizzard. Dutch intelligence services named it Laundry Bear earlier this year. All three names point to the same crew, working in support of Russian state interests. We first covered this group on 29 July 2026, when the Zimbra zero-day it used the month before was already live against targets.
The campaign was spotted about a week ago.
How did the attack work?
Victims only had to open an email. No clicking, no attachments. Proofpoint calls this a "half-click exploit" because reading the message in the browser is enough to trigger the code.
The hackers abused CVE-2026-42897, a cross-site scripting bug in Outlook Web Access, which is the browser-based version of Outlook. Cross-site scripting means the server failed to clean up HTML in the message body, letting hidden JavaScript run as if it were part of the trusted webmail page.
Proofpoint says the malicious code was hidden in the web addresses of social-media icons in the email footer, tucked after the '#' character where most people would never look.
Subject lines were dull on purpose: supply-chain reports, tourism figures, gas-market updates. "The subject lines and lures are banal, likely so the targeted user opens and skims the message, but dismisses the message as junk without reporting it," Proofpoint wrote. No suspicious URLs, no attachments: nothing to flag.
What does OWAReaper actually do?
OWAReaper is the backdoor that gets planted. Proofpoint describes it as the most sophisticated tool of its kind they've seen delivered this way.
Once it runs inside the reading pane, it quietly rewrites the original email on the Exchange server to scrub the exploit code, so investigators find nothing unusual. It disables pop-ups and the right-click menu while it works.
Then it collects the account's email address and username, and tries to steal saved passwords by planting invisible form fields that the browser auto-fills.
Why can't victims just change their passwords?
Because the attackers grant themselves permission at the server level, not at the user's device. Resetting a password doesn't undo it.
OWAReaper looks for Outlook add-ins that already hold ReadWriteMailbox permissions, steals their OAuth tokens (the digital passes proving an app is authorised), and then grants "Owner" rights over every mail folder to a built-in low-level account called "Default" that exists in all Microsoft Exchange tenants.
After that, any authenticated user inside the organisation can read the victim's mailbox. Wiping the laptop does nothing. Rotating credentials does nothing. The permission sits on the Exchange server.
A second trick injects a hidden iframe into cached messages stored offline, so the malware fires again every time the victim opens one of those emails.
Timeline and scope
| Date | Event |
|---|---|
| March | TA488 builds attack infrastructure |
| 14 May | Microsoft publishes advisory for CVE-2026-42897 |
| Last week | Proofpoint spots active OWAReaper campaign |
| Earlier in 2025 | Same group used CVE-2025-66376 zero-day against Zimbra |
Proofpoint attributes this activity to TA488 at medium confidence, based on overlapping tradecraft with ZimReaper, the malware the same group used against Zimbra mail servers to steal email, two-factor codes and application passwords. That's a meaningful caveat: a single vendor's behavioral overlap, without corroborating telemetry, is attribution worth watching rather than treating as settled.
OWAReaper reaches its operators two ways: encrypted commands hidden in public GitHub commit messages, and specially formatted emails delivered directly to the victim's inbox. Stolen data leaves over HTTPS through image content delivery networks, with a DNS-based fallback.
What should organisations do?
Apply Microsoft's May patch for Outlook Web Access if you haven't already. Audit mailbox folder permissions for unexpected "Owner" grants to the Default account. Review Outlook add-ins with ReadWriteMailbox rights and revoke any unrecognised ones. Proofpoint has published indicators of compromise, including the domains used and the exploit's HTML pattern.
Organisations still running on-premises Exchange 2016 or 2019 face a harder problem: as we reported on 22 July, Microsoft ends security patches for those versions in October 2026, leaving any outstanding OWA vulnerabilities permanently unpatched.
