Cleaning Out Inboxes TA488 Comes for Outlook with Another Half-Click Exploit
Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit
On 22 July 2026, one day prior to Proofpoint’s recent joint release with the NSA on the Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear), the actor began a campaign abusing CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA). TA488 is doubling down on the use of “half-click” exploits - where opening the email is enough to trigger compromise - with significantly improved loading mechanisms, techniques, and malware, signaling an improvement in the group’s tradecraft and capability. This novel infection chain ends with a previously unknown JavaScript browser-based implant we call OWAReaper, purpose-built for persistent access inside OWA. The campaign targeted US and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors. The earliest infrastructure used in this campaign was created in March 2026, two months prior to Microsoft’s out-of-band patch for CVE-2026-42897; it is feasible that TA488 used this vulnerability as a zero-day.
TA488 used a series of compromised accounts to send emails exploiting a vulnerability in Outlook Webmail. If the email is opened in Outlook Webmail, the Outlook Exchange server mishandles the HTML from the message and runs arbitrary JavaScript. This executes the payload in the message body, an implant Proofpoint calls OWAReaper. TA488 used intentionally vague message lures with no call-to-action for the targeted user. The message bodies were set up to mimic informational emails on topics such as supply chain analyses, research updates, and more general indicators or metrics for tourism or gas markets. The messages exploit CVE-2026-42897, a vulnerability in Outlook Web Access in which the server does not adequately sanitize HTML in the message body. This allows a loader piece of JavaScript to use the onload= event handler to parse the rest of the message body, assemble a Base64 fragment, and execute it as encoded JavaScript. The initial exploit trigger and relevant payload blobs are stored in the social media icons shown in the message body HTML.
OWAReaper is the most sophisticated backdoor delivered via half-click exploits that Proofpoint has observed at the time of writing, primarily due to its suite of subtle persistence mechanisms. OWAReaper runs inside the OWA browser context, operating as a stealthy implant with no host footprint, using two C&C communication channels and two data exfiltration protocols. It is capable of surviving browser reboots, credential rotation, and full re-imaging of the victim’s device. Upon execution, OWAReaper uses Outlook APIs to rewrite the email on the Exchange server and remove the exploit content. It then writes an encrypted version of itself, and a decryption wrapper, into the browser’s localStorage, under settings fields in the PageDataPayload.OwaUserDefaultSettings key. Every time the user opens an OWA tab in the browser, the normal OWA sync process automatically executes OWAReaper. It then calls UpdateFolder to grant itself Owner-level permissions to the “Default” user on every mail folder, which grants full access to the mailbox to any authenticated user in the same organization. This persistent access lives on the server-side and requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user’s device will not evict the actor. OWAReaper also creates a final persistence method by adding a hidden iframe to messages stored in OWA’s offline IndexedDB message cache and enables caching. OWAReaper can use one of two methods for command and control: commands are either fetched from public GitHub commit messages or read via inbound emails sent by the attacker. OWAReaper implements two distinct data exfiltration protocols, with the primary method occurring over HTTPS and a fallback to DNS label tunneling if HTTPS fails.