Russian state-backed hackers are exploiting an Exchange server flaw to break into unpatched Outlook Web Access accounts, steal credentials and maintain access to mailboxes, according to research published Thursday by Proofpoint.
Proofpoint attributes the activity to TA488, a group it says operates for the Kremlin. The group is also tracked as Laundry Bear and Void Blizzard. Proofpoint and the National Security Agency warned last week that the same group had been attacking Zimbra mail servers with a zero-day vulnerability. Proofpoint now says TA488 is also using a Microsoft Exchange Server bug in attacks that can trigger when a target opens a malicious email in Outlook Web Access, or OWA.
What is the Exchange server flaw being exploited?
The vulnerability is CVE-2026-42897, a cross-site scripting bug in Exchange Server. Cross-site scripting, or XSS, lets an attacker run their own JavaScript in a victim’s browser because an application fails to filter hostile content properly. In this case, Proofpoint says the flaw comes from Exchange failing to adequately handle HTML embedded in an email.
Microsoft issued mitigation guidance for CVE-2026-42897 in May and patched it in July, according to its security advisory. Microsoft rated the vulnerability at maximum severity. Proofpoint said TA488 may have used the bug before Microsoft released a patch, which would make the activity zero-day exploitation.
The attack is what researchers call a “half-click” exploit: the target does not need to open an attachment or click a link. Proofpoint says viewing the email in OWA is enough to start the infection chain.
How does OWAReaper stay on an account?
Proofpoint named the malware OWAReaper and described it as a previously unknown JavaScript implant built for persistent access inside OWA. The company said it is the most advanced backdoor it has seen delivered through this kind of half-click technique.
According to Proofpoint, the malicious JavaScript runs in the OWA reading pane, then uses Outlook APIs to modify the message on the Exchange server and remove the exploit material. While it runs, it disables OWA pop-ups and right-click actions. It also creates a target-specific session key and collects the victim’s email address, username and Outlook settings.
Proofpoint said OWAReaper then creates invisible form fields in the browser document and waits for browser autofill to supply saved OWA credentials. After that, it stores an encrypted copy of itself and a decryption wrapper in the browser’s localStorage under a legitimate OWA settings key. Because OWA uses that key during its normal page restore process, the implant can run again whenever the user opens an OWA tab.
In many cases, Proofpoint said, the backdoor can steal OAuth tokens and use them to reach the mailbox of any authenticated user on the same network. The company warned that this persistence is server-side, so changing passwords or rebuilding the victim’s device may not remove the attacker’s access.
What should Exchange administrators do?
Proofpoint said it is not clear whether Microsoft’s July patch or the separate Exchange Emergency Mitigation service removes OWAReaper from already compromised systems. Patching still closes the known hole, but cleanup may require direct inspection and removal.
Proofpoint advised affected organizations to revoke and audit Exchange Web Services tokens for unauthorized add-ins. It also recommended removing folder permissions granted to default users, clearing the OWA indexDB and the PageDataPayload.owaUserDefaultSettings local storage key, and blocking or alerting on outbound connections to the command-and-control domains asecdns[.]com, acocdn[.]com, dnsrecursive[.]eu and tdndns[.]com.
This story draws on original reporting from Ars Technica.
