TA488 Exploited Outlook Web Access Zero-Day Before Microsoft Patch
A sophisticated campaign by TA488 leveraged a zero-day vulnerability in Outlook Web Access, allowing mailbox compromise via specially crafted emails before Microsoft issued an emergency patch.
A new campaign orchestrated by the threat actor TA488 has been identified, exploiting a zero-day vulnerability in Outlook Web Access (OWA) to achieve mailbox compromise. The vulnerability, tracked as CVE-2026-42897, allowed attackers to execute malicious JavaScript simply by opening a specially crafted email within the OWA interface. This method bypassed the need for harmful attachments or links, making the phishing attempts more insidious and harder to detect.
Proofpoint researchers, who named the browser-based implant OWAReaper, observed that the campaign targeted government entities and corporations across the United States and Europe, spanning sectors such as telecommunications, finance, hospitality, and aerospace. The group had reportedly been refining its techniques, enhancing the loading, persistence, and data theft capabilities of its "half-click" attacks. This discovery underscores the critical importance of timely patching for widely used email platforms.
The exploitation chain began on July 22, 2026, according to researchers, just before public reports linked TA488 (also known as Void Blizzard and Laundry Bear) to other webmail-related attacks. The threat actor used compromised accounts to distribute seemingly innocuous messages concerning supply chains, energy, tourism, public health, and market metrics. The intent was to craft lures that recipients would open and briefly review, rather than immediately flag as suspicious.
Upon opening the malicious email in OWA, the Exchange server failed to properly sanitize parts of the message's HTML content. This flaw enabled a hidden JavaScript loader to reconstruct and execute the OWAReaper payload directly within the user's active browser session. Evidence suggests TA488 may have been exploiting CVE-2026-42897 as a zero-day for months, with the oldest associated infrastructure dating back to March 2026, predating Microsoft's emergency patch.
Microsoft eventually released permanent updates for supported Exchange versions, and CISA urged organizations to apply these patches and mitigations promptly. The agency also advised reviewing exposure to internet-facing Exchange systems. The OWAReaper implant operates entirely within the OWA browser environment, minimizing its footprint on the endpoint. It possesses the capability to exfiltrate mailbox details, user settings, and stored browser credentials, storing an encrypted copy of itself in browser storage.
A particularly concerning persistence mechanism employed by OWAReaper involves altering mailbox folder permissions. This modification can grant a low-privileged default account owner-level access to various folders. Crucially, this server-side access can persist even after a victim resets their password or their computer is rebuilt, unless administrators specifically intervene to remove the altered permissions.
Command and control for OWAReaper is managed through various methods, including retrieving encrypted instructions from GitHub commit messages or parsing commands embedded within incoming emails. It can also utilize HTTPS traffic routed through image delivery services, with DNS tunneling serving as a fallback for data exfiltration. The campaign highlights the evolving nature of email-borne threats, emphasizing that attacks are not solely reliant on attachments or links.
To defend against such threats, organizations must prioritize installing Exchange updates and maintaining compensating controls. This includes auditing Exchange Web Services tokens, removing improper default folder permissions, clearing affected Outlook browser storage, and monitoring network connections to known command-and-control infrastructure. Furthermore, security teams should investigate unusual OWA behavior, such as suspicious scripts or anomalous permission changes, and continuously educate users about deceptive but seemingly harmless messages.
This new report details the specific technical mechanisms employed by the threat actors, including the use of CVE-2026-42933, a cross-site scripting vulnerability in Microsoft Outlook Web Access (OWA), and the deployment of a sophisticated JavaScript implant named OWAReaper. OWAReaper enables persistent server-side access by rewriting emails and disabling OWA features, and can even re-infect targets via the browser's offline cache, making it resilient to credential rotation and device re-imaging.