According to Proofpoint, a Russia-aligned threat group tracked as TA488 (aka Laundry Bear or Void Blizzard) is running a sophisticated “half-click” email exploit campaign against Microsoft Exchange Outlook Web Access (OWA), targeting US and European government bodies and telecom, financial, hospitality, and aerospace firms. The threat actor group weaponizes CVE-2026-42897, a cross-site scripting (XSS) flaw caused by improper HTML sanitization, so that simply viewing a crafted email in OWA executes malicious JavaScript where no link clicks or attachments are required. Emails are intentionally bland, mimicking routine supply chain or market updates, with payloads hidden in social media icon URLs and Base64 fragments. The exploit installs OWAReaper, a browser-based JavaScript backdoor that runs entirely in the OWA reading pane. OWAReaper removes exploit traces from the stored message, steals account details and autofilled credentials, and writes an encrypted copy of itself to localStorage and IndexedDB, ensuring re-execution on future OWA sessions and cached emails. Critically, OWAReaper can use Outlook add-ins with ReadWriteMailbox permissions to steal OAuth tokens and grant Owner-level mailbox permissions to Exchange’s “Default” identity, creating server-side persistence that survives password resets and endpoint reimaging. It supports two (2) command and control (C2) channels (GitHub commits and inbound emails) and two (2) exfil methods (HTTPS with AES-CTR and DNS tunneling). Proofpoint notes overlaps with TA488’s earlier ZimReaper attacks on Zimbra, and that infrastructure predates Microsoft’s disclosure, suggesting possible zero-day use. CTIX Analysts recommend that organizations should review and revoke Exchange Web Services tokens for any suspicious add-ins, audit and remove mailbox folder permissions granted to the “Default” user, and wipe OWA-specific browser storage (IndexedDB’s owa_offline_db and the PageDataPayload.OwaUserDefaultSettings localStorage key) on affected machines. Additionally, network teams should also monitor and block outbound traffic to known TA488 C2 infrastructure.