Malware
OWAReaper
- First Reported
- Jul 28, 2026
- Latest Reported
- Aug 7, 2026
Reported Context (2)
- A TTP Instance detailed CL-STA-1114's abuse of CVE-2025-66376, and a Validated Intelligence Event detailed TA488's exploitation of CVE-2026-42897 to deploy OWAReaper. Recorded Future Identifies 85 High-Impact Vulnerabilities in July, Many Actively Exploited
- This novel infection chain ends with a previously unknown JavaScript browser-based implant we call OWAReaper, purpose-built for persistent access inside OWA. TA488 Uses Outlook Web Access XSS to Deploy Persistent OWAReaper Implant
CVE (81)
Malware (4)
Threat Actors (10)
MITRE ATT&CK (9)
Vendors (25)
Products (73)
Tools (2)
Industries (6)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.