Russian hackers exploit Exchange OWA zero-day for long-term mailbox access

Russian state-sponsored threat actor Laundry Bear (also known as Void Blizzard or TA488) is exploiting a zero-day cross-site scripting (XSS) vulnerability, CVE-2026-42897, in Microsoft Exchange Outlook Web Access (OWA) to deliver a sophisticated backdoor called OWAReaper. This 'half-click' exploit requires only that the user open a malicious email, which executes JavaScript due to improper HTML sanitization, enabling deployment of the payload without user interaction. OWAReaper establishes long-term persistence by abusing Outlook add-ins to steal OAuth tokens and granting Owner-level permissions to mail folders via the Default user, allowing continued access even after credential resets or system reimaging. The malware uses multiple command-and-control mechanisms, including GitHub commit messages and email parsing, and supports multiple data exfiltration methods, including encrypted HTTPS and DNS tunneling.

AI-extracted · verify before operational use