Proofpoint Details Laundry Bear’s OWA Zero-Day Campaign and OWAReaper Backdoor
Summary
Proofpoint reports that Laundry Bear used CVE-2026-42897 in crafted OWA emails to deliver OWAReaper, which can maintain mailbox access through server-side permissions and cached messages, steal credentials, and communicate or exfiltrate data through multiple channels.
Key points
- Proofpoint says Laundry Bear, also tracked as TA488 and Void Blizzard, targeted government and industry organizations in the U.S. and Europe.
- The campaign exploited CVE-2026-42897, an OWA XSS flaw, through crafted emails that triggered when opened; the article says Microsoft later reported the flaw was exploited as a zero-day.
- OWAReaper runs in the OWA reading pane and removes exploit content from the email after execution, according to Proofpoint.
- The backdoor attempts to steal credentials and can use Outlook add-ins to obtain OAuth tokens and grant mailbox-folder permissions that persist through password changes or system restoration.
- A second persistence method uses a malicious iframe in cached OWA messages stored in IndexedDB.
- OWAReaper can receive commands through GitHub commit messages or specially formatted mailbox emails; it can exfiltrate data over HTTPS or use DNS as a fallback.
- Proofpoint attributed the campaign to TA488 based on behavioral similarities to ZimReaper activity and the use of half-click XSS against webmail.
Article Details
- Attack Vectors
- A crafted email triggers an Outlook Web Access cross-site scripting exploit when the recipient opens the message; no suspicious URL or attachment is required.
- The injected JavaScript loader delivers Base64-encoded payload blobs embedded in social-media icon URLs.
- OWAReaper steals credentials by adding invisible elements to the Document Object Model and waiting for the browser to autofill them.
- OWAReaper obtains OAuth tokens through Outlook add-ins with ReadWriteMailbox permissions, then grants Owner-level permissions on mail folders to maintain mailbox access.
- The malware persists by caching content and injecting an iframe into messages stored in OWA's offline IndexedDB.
- The malware retrieves instructions through GitHub commit messages and target-mailbox emails, and exfiltrates data over HTTPS or, as a fallback, DNS.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe email embeds Base64-encoded payload blobs in social-media icon URLs.T1048.001 · Exfiltration Over Symmetric Encrypted Non-C2 ProtocolThe malware exfiltrates data over HTTPS using AES-CTR-encrypted URI paths.T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolAs a fallback, the malware encrypts data, encodes it with Base32, and exfiltrates it through DNS.T1059.007 · JavaScriptThe exploit uses a JavaScript loader that executes in the OWA reading pane.T1098.002 · Additional Email Delegate PermissionsOWAReaper grants Owner-level permissions to the Default user on mail folders to maintain mailbox access.T1102.003 · One-Way CommunicationOWAReaper polls GitHub's Commit Search API for encrypted messages containing instructions.T1203 · Exploitation for Client ExecutionThe crafted email triggers the OWA XSS flaw when opened, causing JavaScript to execute in the browser.T1528 · Steal Application Access TokenOWAReaper uses Outlook add-ins and the GetClientAccessToken operation to steal OAuth tokens.
CVE
CVE-2025-66376Previously, the same hackers leveraged another XSS vulnerability (CVE-2025-66376) as a zero-day in Zimbra email servers to deliver malware ZimReaper that steals email communication, two-factor authentication (2FA)CVE-2026-42897Laundry Bear, also tracked as Void Blizzard and TA488, is using the CVE-2026-42897 Outlook Web Access XSS flaw in half-click email attacks to deliver the OWAReaper backdoor.
Threat Actors
Laundry BearThe article attributes the OWAReaper campaign and exploitation of CVE-2026-42897 to Laundry Bear; Proofpoint based its attribution on behavioral overlaps with ZimReaper activity and half-click XSS targeting.TA488The article identifies Void Blizzard as another name for Laundry Bear, which it attributes with the OWAReaper campaign.
Malware
Vendors
Products
GitHubThe malware uses multiple C2 and exfiltration methods, including GitHub, HTTPS, and DNS.Microsoft Exchange ServerThe Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper.Outlook on the webLaundry Bear, also tracked as Void Blizzard and TA488, is using the CVE-2026-42897 Outlook Web Access XSS flaw in half-click email attacks to deliver the OWAReaper backdoor.ZimbraPreviously, the same hackers leveraged another XSS vulnerability (CVE-2025-66376) as a zero-day in Zimbra email servers to deliver malware ZimReaper that steals email communication, two-factor authentication (2FA)
Countries
Industries
Aerospaceand Europe, and companies in the telecommunications, financial, hospitality, and aerospace sectors.financialand Europe, and companies in the telecommunications, financial, hospitality, and aerospace sectors.GovernmentThe campaign targets government and industry organizations across the U.S.Hospitalityand Europe, and companies in the telecommunications, financial, hospitality, and aerospace sectors.Telecommunicationsand Europe, and companies in the telecommunications, financial, hospitality, and aerospace sectors.