Product
Outlook Web Access
- First Reported
- Jun 16, 2026
- Latest Reported
- Sep 7, 2026
Reported Context (3)
- login page, Microsoft issues an authentication cookie (ESTSAUTH for Azure AD, AppSessionId for Outlook Web Access) in the HTTP response Set-Cookie header. Since all traffic flows through Evilginx2's proxy, the CloudSEK Details BigBear 2.0 Evilginx2 Campaign That Hijacked Microsoft 365 Sessions
- the actor began a campaign abusing CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA). TA488 Uses Outlook Web Access XSS to Deploy Persistent OWAReaper Implant
- and used false DNS records to stage adversary-in-the-middle attacks against services such as Outlook Web Access. Report Details Russian Router Hijacking and Messaging-Account Operations
CVE (1)
Malware (2)
Threat Actors (13)
MITRE ATT&CK (46)
Vendors (3)
Products (12)
Tools (3)
Industries (15)
Countries (8)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.