Overview
- Proofpoint attributed the active campaign to the Russia-aligned group Laundry Bear and said it began on July 22, 2026 when spearphishing emails exploiting CVE-2026-42897 delivered a JavaScript implant called OWAReaper.
- The exploit is a 'half-click' XSS in on-premises Outlook Web Access that runs JavaScript when a user opens an email, allowing the implant to execute inside the victim's authenticated browser session.
- OWAReaper establishes durable persistence by rewriting mail on the Exchange server, hiding an encrypted copy in browser localStorage, planting hidden iframes in OWA's offline IndexedDB, and stealing OAuth tokens to grant Owner-level Default-user folder permissions.
- The malware uses two command channels (GitHub commits and attacker-sent or polled emails) and dual exfiltration routes (HTTPS proxied through CDN image domains with a DNS fallback), and Proofpoint says its infrastructure dates to March 2026.
- Defenders should apply Microsoft Exchange updates, revoke Exchange Web Services and OAuth tokens, remove unauthorized folder grants on the server, and clear OWA IndexedDB and localStorage keys because password resets or device re-imaging alone will not remove server-side access.