TA488 Uses Outlook Web Access XSS to Deploy Persistent OWAReaper Implant
Summary
Proofpoint reports that TA488 exploited CVE-2026-42897 in Outlook Web Access to target government and other organizations with OWAReaper, a browser-based implant designed to steal credentials and maintain mailbox access.
Key points
- The campaign began on July 22, 2026, using vague emails without links or attachments to target US and European government entities and organizations in several sectors.
- Opening a message in OWA triggers JavaScript execution through CVE-2026-42897, an XSS vulnerability caused by inadequate sanitization of message-body HTML.
- OWAReaper runs in the OWA browser context, captures saved credentials and OAuth tokens, and establishes mailbox access through Exchange folder permissions.
- The implant persists through OWA settings and cached messages, and may survive browser restarts, credential rotation, and device re-imaging.
- It receives commands through GitHub commit messages or attacker-sent emails, and exfiltrates data over HTTPS or, as a fallback, DNS tunneling.
- Proofpoint says campaign infrastructure predates Microsoft’s out-of-band patch, making possible zero-day use feasible but unconfirmed.
- Recommended response includes auditing and removing Default-user folder permissions, revoking and auditing EWS tokens, clearing specified OWA browser storage, and blocking or alerting on C2 connections.
Article Details
- Attack Vectors
- TA488 sent vague, informational lure emails from compromised accounts. Opening the messages in Outlook Web Access triggered exploitation of CVE-2026-42897, allowing embedded JavaScript to execute without a click, attachment, or suspicious URL.
- The exploit delivered OWAReaper, which harvested saved OWA credentials and OAuth tokens, modified Exchange mailbox permissions, and established persistence in OWA settings and the offline message cache.
- OWAReaper received commands through GitHub commit messages or inbound emails. It exfiltrated data over HTTPS, using image CDN proxies or direct C2 communication, and fell back to DNS label tunneling.
- Defensive Notes
- Apply the available Microsoft patch and mitigation guidance for CVE-2026-42897.
- Revoke and audit Exchange Web Services tokens for affected add-ins.
- Audit and remove Exchange folder permission grants to the Default user.
- Clear OWA's IndexedDB (owa_offline_db) and the PageDataPayload.OwaUserDefaultSettings localStorage key on affected endpoints.
- Block or alert on outbound connections to the reported C2 servers.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | acocdn[.]com | TA488-controlled domain used to relay encrypted exfiltration and receive files. |
| DOMAIN | asecdns[.]com | OWAReaper C&C domain; used for DNS-tunnel exfiltration. |
| DOMAIN | dnsrecursive[.]eu | Listed in the article's OWAReaper campaign indicators. |
| DOMAIN | tdndns[.]com | Listed in the article's OWAReaper campaign indicators. |
| SHA256 | 6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4 | Hash of an HTML message body containing the exploit and OWAReaper payload. |
MITRE ATT&CK
T1056.003 · Web Portal CaptureOWAReaper creates invisible DOM input elements and uses browser autofill to capture saved OWA credentials.T1059.007 · JavaScriptOWAReaper executes JavaScript payloads in the browser, including arbitrary code received through its command mechanisms.T1071.001 · Web ProtocolsThe implant communicates and exfiltrates data over HTTPS, including through image CDN proxies or direct C2 requests.T1071.004 · DNSWhen HTTPS exfiltration fails, OWAReaper encodes data in DNS query subdomain labels.T1098.002 · Additional Email Delegate PermissionsOWAReaper grants the Default user Owner-level permissions on mailbox folders to maintain access.T1114.003 · Email Forwarding RuleThe implant parses inbound emails stored in OWA's offline cache for operator commands.T1189 · Drive-by CompromiseOpening a crafted email in OWA triggers the XSS exploit and executes the payload in the webmail context.T1547.001 · Registry Run Keys / Startup FolderOWAReaper stores an encrypted implant and decryption wrapper in OWA localStorage settings that execute during the normal sync-restore flow.T1567.002 · Exfiltration to Cloud StorageOWAReaper routes HTTPS exfiltration through image CDN services, including Weserv.nl, WordPress's image CDN, and Slack's image CDN.
CVE
Threat Actors
Malware
OWAReaperThis novel infection chain ends with a previously unknown JavaScript browser-based implant we call OWAReaper, purpose-built for persistent access inside OWA.ZimReaperThe malware is an evolution of the ZimReaper payload used in previous campaigns, and shares significant code and behavioral overlaps, including with how the tools gather autofill passwords from the DOM (with the same
Vendors
Products
GitHubCommands are either fetched from public GitHub commit messages or read via inbound emails sent by the attacker.Microsoft Exchange ServerIf the email is opened in Outlook Webmail, the Outlook Exchange server mishandles the HTML from the message and runs arbitrary JavaScript.Outlook Web Accessthe actor began a campaign abusing CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA).
Tools
Countries
Industries
AerospaceThe campaign targeted US and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors.DefenseBased on newly observed activity, TA488 appears to demonstrate interest in a wide range of sectors while maintaining priorities for intelligence collection against government and defense.financialThe campaign targeted US and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors.GovernmentThe campaign targeted US and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors.HospitalityThe campaign targeted US and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors.TelecommunicationsThe campaign targeted US and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors.