The Half-Click Nightmare: How Laundry Bear Weaponized an Exchange OWA Zero-Day
The Russian state-sponsored hacking group known as Laundry Bear (also tracked as Void Blizzard and TA488) has pulled off something quietly terrifying: they're exploiting a Microsoft Exchange vulnerability to maintain long-term, persistent access to victim mailboxes — and they've been doing it since at least March 2026, well before Microsoft even knew the hole existed.
Email security firm Proofpoint spotted the campaign recently, and what they found was far more sophisticated than typical phishing operations. This isn't some script-kiddie operation. Laundry Bear has built what Proofpoint calls "the most sophisticated backdoor delivered via half-click exploits" the firm has ever observed. The malware, dubbed OWAReaper, was designed to linger, adapt, and keep working even if victims rotate credentials or rebuild their systems.
The targets? Government entities across the U.S. and Europe, plus companies in telecommunications, finance, hospitality, and aerospace. The lures? Banal-looking emails about supply-chain analyses, research updates, and tourism or gas market performance indicators. Nothing flashy. Nothing that screams "look at me." Just enough to get a victim to open the email — which, as it turns out, is all the attacker needs.
How the Half-Click Exploit Works
CVE-2026-42897 is a cross-site scripting (XSS) vulnerability in Microsoft's Outlook Web Access (OWA). When users open a specially crafted email in OWA, the server fails to properly sanitize the HTML body, allowing arbitrary JavaScript to execute in the browser context. The exploit is sometimes called a "half-click" because victims don't even need to click anything — just opening the email in the reading pane triggers the vulnerability.
The attack infrastructure was built by Laundry Bear in March 2026, nearly two months before Microsoft released its advisory on May 14, 2026. That gap matters. It means attackers had time to refine their tools, test them against real targets, and build out the full campaign before the security community even caught wind.
Emails delivered through this campaign contained a JavaScript loader and Base64-encoded payload blobs embedded in social media icon URLs after the '#' character. No suspicious links. No attachments. Just carefully crafted HTML that exploited the improper sanitization flaw to inject malicious code directly into the message body.
OWAReaper: The Backdoor Lives in the Browser
Here's where things get interesting. OWAReaper doesn't install anything on the victim's machine. It executes entirely within the Outlook Web Access reading pane — meaning it runs in the browser context, leveraging OWA's own APIs against the organization.
Once triggered, the malware immediately rewrites the email on the Exchange server to strip out the exploit content. It also disables OWA pop-ups and right-click functionality while it runs. The goal? Stay invisible. The malware collects the compromised account's email address, username, and Outlook settings, then quietly begins its persistence work.
It also attempts to steal credentials by creating invisible elements in the Document Object Model (DOM) and waiting for the browser to auto-fill them. Clever. Annoyingly so.
This backdoor represents an evolution of ZimReaper, malware Laundry Bear previously used against Zimbra email servers. The similarities in behavior and technique are what led Proofpoint to attribute the OWAReaper campaign to TA488.
Long-Term Persistence: Because One Backdoor Isn't Enough
What makes OWAReaper particularly dangerous is its persistence mechanisms. Laundry Bear designed this malware to maintain access even if the victim's system is restored from a clean image or credentials are rotated. That's a level of sophistication that speaks to long-term espionage goals, not quick hit-and-run operations.
The first persistence mechanism involves checking for installed Outlook add-ins that have ReadWriteMailbox permissions. OWAReaper uses these add-ins to steal OAuth tokens through the GetClientAccessToken operation request. It then calls UpdateFolder to grant itself Owner-level permissions to the 'Default' user alias — a low-permission preset that exists in all Microsoft Exchange tenants — on every mail folder.
Why does this matter? Because mailbox permissions are configured on the server side. Changing the compromised user's credentials or reinstalling the affected system doesn't revoke the attacker's access. They can access the mailbox from any authenticated account within the organization. That's a serious problem for any enterprise.
The second persistence mechanism is equally clever. OWAReaper enables caching and injects a malicious iframe into the HTML of messages stored in OWA's offline IndexedDB cache. Every time the victim opens a poisoned email from the cache, the iframe executes. It's a backdoor that keeps coming back, no matter what the user does.
Command and Control: Two Channels, Always Listening
OWAReaper implements two distinct command-and-control (C2) mechanisms for receiving instructions from attackers, ensuring redundancy and resilience.
The first uses GitHub commit messages as a communication channel. Every 24 hours, the malware queries GitHub's Commit Search API for encrypted messages that match a specific format and include the target's email address. This is a creative use of a legitimate platform — attackers blending into the noise of public code repositories.
The second C2 method involves parsing emails delivered to the target's mailbox. The malware checks the IndexedDB for message bodies containing a specific structure: the target's email address, followed by a space, followed by Base64-encoded text. This dual-channel approach ensures that even if one method is disrupted, the other continues to function.
Data Exfiltration: Encryption, Proxies, and Fallbacks
Laundry Bear didn't leave anything to chance when it came to data exfiltration. The primary method uses HTTPS with AES-CTR encrypted URI paths that are proxied through certain image content delivery network (CDN) domains. This makes the traffic look like normal image requests, blending in with regular web traffic.
If the primary method fails, data is delivered directly to the attacker's server, which is defined in the function that initializes outbound network sessions. There's also a DNS exfiltration fallback, where data is encrypted and encoded in packets using Base32 encoding. Two methods for exfiltration. Two methods for C2. This is the work of a sophisticated threat actor that plans for failure.
Attribution and What Comes Next
Proofpoint attributed the OWAReaper campaign to TA488 based on behavioral overlaps with ZimReaper activity and the consistent use of half-click XSS exploits to target webmail viewers for espionage purposes. The group's previous exploitation of CVE-2025-66376 (another XSS vulnerability in Zimbra) to deliver ZimReaper malware — which steals email communications, two-factor authentication codes, application passcodes, and passwords — shares clear similarities with this campaign.
The researchers published a small set of indicators of compromise (IoCs), including the domains used and the HTML message body containing the CVE-2026-42897 exploit and OWAReaper payload. Organizations should be reviewing their Exchange Server logs for signs of this activity, particularly any unusual OAuth token requests or unexpected Outlook add-in permissions.
For security teams, the lesson is clear: half-click exploits on webmail platforms are no longer theoretical. They're happening now, by sophisticated nation-state actors, and they're designed to persist indefinitely. Patching is important, but it's not enough. Organizations need to monitor for unusual OAuth token requests, review Outlook add-in permissions regularly, and implement detection rules for the specific patterns OWAReaper uses.
The fact that this campaign was operational for months before Microsoft's advisory is a reminder that zero-days in enterprise environments are often exploited long before the public knows they exist. The question isn't whether your organization will face a half-click exploit — it's whether you'll be ready when it happens.
