Critical Outlook Web Access Zero-Day Exploited by TA488, Microsoft Patches

Key Takeaways

• The TA488 threat group exploited a zero-day cross-site scripting (XSS) vulnerability, CVE-2026-42897, in Microsoft Outlook Web Access (OWA).
• This vulnerability allowed for remote code execution by merely opening a malicious email in the OWA interface, without requiring dangerous attachments or links.
• The campaign targeted government, telecommunications, finance, hospitality, and aerospace sectors in the U.S. and Europe.
• Microsoft has since released patches for this critical flaw, and organizations are urged to apply them immediately.
• The attacker-controlled implant, named OWAReaper, establishes persistence, steals credentials and mailbox data, and can modify folder permissions, surviving password resets and system reinstallation.

A sophisticated campaign orchestrated by the TA488 threat group has leveraged a critical zero-day vulnerability in Microsoft Outlook Web Access (OWA), transforming seemingly innocuous emails into potent vectors for mailbox compromise. The attack, which exploited a cross-site scripting (XSS) flaw tracked as CVE-2026-42897, permitted malicious code execution when a recipient simply opened an email within the webmail interface.

This advanced operation targeted a diverse range of high-value sectors, including government entities and organizations in telecommunications, finance, hospitality, and aerospace across both the United States and Europe. What makes this campaign particularly insidious is its departure from conventional phishing tactics; the malicious emails required no harmful attachments or suspicious links, making them exceptionally difficult to detect in busy inboxes.

Cybersecurity firm Proofpoint played a pivotal role in identifying this activity, naming the browser-based implant utilized in the attacks “OWAReaper.” Proofpoint said in a report that the TA488 group has significantly enhanced the loading, persistence, and data exfiltration capabilities of its “half-click” attack methodology. The discovery of this campaign underscores the urgency for a comprehensive response to the Outlook Web Access vulnerability. Previous reports on this Microsoft Exchange server vulnerability highlighted its impact on on-premises Exchange deployments, enabling attackers to execute arbitrary JavaScript within an authenticated user’s browser session.

TA488 May Have Exploited Outlook Web Access 0-Day Flaw

According to researchers, TA488 initiated its exploitation of CVE-2026-42897 as early as July 22, 2026. This timeline is significant, as the campaign emerged shortly before public disclosures linked the Russia-aligned group, also known as Void Blizzard and Laundry Bear, to prior attacks against webmail platforms. The earliest infrastructure associated with this operation was established in March 2026, approximately two months before Microsoft released an emergency patch for the vulnerability. This suggests that TA488 likely had access to and exploited the flaw as a zero-day, giving them a critical advantage before defensive measures could be implemented.

The threat group employed compromised accounts to disseminate emails containing vague subject matter related to supply chains, energy, tourism, public health, and market metrics. These topics were carefully selected to appear sufficiently mundane and legitimate, encouraging recipients to open and briefly review the messages rather than immediately flagging them as suspicious. When a victim opened such an email in Outlook Web Access, the underlying Exchange server mishandled certain elements of the message’s HTML content. This error allowed a concealed JavaScript loader to reconstruct and execute the OWAReaper payload directly within the browser’s active Outlook session.

Microsoft has since rolled out permanent updates for all affected, supported versions of Exchange. The Cybersecurity and Infrastructure Security Agency (CISA) has also issued a strong recommendation for organizations to promptly apply these updates and implement any additional mitigations. Furthermore, CISA’s Exchange vulnerability warning advises organizations to scrutinize their internet-facing Exchange systems.

OWAReaper Builds Persistence

OWAReaper is designed to operate stealthily within the Outlook Web Access browser environment, minimizing its traditional malware footprint on endpoints. This implant is capable of harvesting sensitive mailbox details, user settings, and saved browser credentials. To maintain persistence, it stores an encrypted copy of itself within Outlook-related browser storage. This method allows it to evade detection by conventional endpoint security solutions.

Beyond data exfiltration, OWAReaper also attempts to manipulate mailbox folder permissions. This can grant a low-privileged default account owner-level access to critical folders. Such server-side access is particularly dangerous because it can persist even after password resets or a complete reinstallation of the victim’s computer, unless administrators proactively identify and revoke the altered permissions.

For command and control (C2), OWAReaper exhibits remarkable versatility. It can retrieve encrypted instructions embedded in crafted GitHub commit messages or parse commands delivered through incoming email. Additionally, it can route stolen information via HTTPS traffic through legitimate image delivery services, utilizing DNS tunneling as a robust fallback method for exfiltration. This multi-channel approach significantly enhances its resilience and makes detection more challenging.

What You Should Do

• Apply Patches Immediately: Ensure all Microsoft Exchange servers are updated with the latest security patches, especially those addressing CVE-2026-42897.
• Review Internet-Facing Systems: Conduct a thorough audit of all internet-facing Exchange systems for any unusual configurations or unauthorized access.
• Revoke and Audit EWS Tokens: Revoke and scrutinize Exchange Web Services (EWS) tokens for any affected add-ins to prevent unauthorized access.
• Remove Improper Folder Permissions: Identify and remove any unauthorized or improperly configured owner-level folder permissions for default accounts.
• Clear Outlook Browser Storage: Clear affected Outlook browser storage to remove any persistent OWAReaper implant copies.
• Monitor C2 Infrastructure: Implement monitoring and blocking rules for network connections to known OWAReaper command-and-control infrastructure (e.g., asecdns[.]com, acocdn[.]com, dnsrecursive[.]eu, tdndns[.]com).
• User Education: Continue to educate users about sophisticated email-borne threats that do not rely on traditional malicious attachments or links, emphasizing vigilance for unexpected OWA behavior.
• Investigate Anomalous Behavior: Promptly investigate any suspicious scripts, unusual permission changes, or anomalous webmail sessions within the Outlook Web Access environment.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.