OWA Bug Lets Russian Hackers Outlive Your Password Reset

Rotate the passwords. Re-image the laptop. Force MFA re-enrollment. For twenty years that has been the muscle-memory response to a compromised mailbox, and for a Russian espionage crew tracked as TA488 it is now a rounding error. Their latest campaign against Outlook Web Access does something that should make every incident-response playbook feel a decade old: it turns the authorization layer itself into the persistence mechanism, so the account can be cleaned, the endpoint wiped, and the attacker still reads every new email that lands.

The delivery vehicle is CVE-2026-42897, a stored cross-site scripting bug in Exchange's Outlook Web Access that Microsoft patched out-of-band on May 14, 2026. Proofpoint dates the group's infrastructure to March — roughly two months before the advisory — which makes this a genuine zero-day, not a patch-gap smash-and-grab. The bug is the boring part. What TA488 (Microsoft calls them Void Blizzard; others use Laundry Bear) built on top of it is the story.

Half a click, and no click at all

OWA fails to sanitize HTML in the message body, so the malware — Proofpoint named it OWAReaper — rides in on an onload= handler bolted to what look like social-media icons. Base64 payload fragments are hidden after # fragments in image URLs, where the browser's own image parser splits them out. There is no attachment to detonate, no link to fool someone into clicking. Rendering the message in the reading pane is the exploit. Proofpoint calls it a "half-click"; functionally it's a zero-click for anyone who previews mail, which is everyone.

Once it runs, OWAReaper does the housekeeping you'd expect from a mature implant: it rewrites the triggering email on the Exchange server to strip the exploit out, suppresses OWA pop-ups and the right-click menu during setup, and plants invisible DOM inputs positioned at -9999px to skim autofilled credentials. If you've seen ZimReaper — the same crew's Zimbra tool from the 2025 campaigns — this is its sibling, sharing password-extraction and error-handling code almost verbatim. One telling change: OWAReaper doesn't bulk-exfiltrate the mailbox. Dragging gigabytes of mail is loud. This version stays quiet and stays resident, which tells you the objective shifted from smash-and-grab collection to long-haul access.

Why credential rotation is now theater

Here is the part defenders need to sit with. OWAReaper finds an Outlook add-in that already holds ReadWriteMailbox permission, calls GetClientAccessToken through it to mint an OAuth token, then issues an UpdateFolder operation that grants the mailbox's Default user Owner-level rights on every folder. That grant lives in the Exchange authorization model, not in a session or a device. As Proofpoint puts it, evicting it "requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user's device will not evict the actor."

Think about what that breaks. Password reset invalidates a secret the attacker no longer needs. MFA re-enrollment protects a login the attacker no longer performs. Re-imaging scrubs an endpoint the attacker was never really living on. The foothold is a folder ACL — an authorization object sitting in your mail store, indistinguishable at a glance from the delegation your CEO's assistant legitimately holds. Every standard containment step sails right past it.

And there's a second layer for the paranoid. OWAReaper writes an encrypted copy of itself plus a decryption wrapper into browser localStorage under PageDataPayload.OwaUserDefaultSettings, and drops a hidden iframe into messages cached in OWA's offline IndexedDB store. OWA's own sync logic re-executes the payload during normal use, so a poisoned cache re-infects the client even after the box is rebuilt — unless someone thinks to clear owa_offline_db. Server-side ACL for durability, client-side browser storage for redundancy. Belt and suspenders.

The C2 hides in your allowlist

The command channel is a small masterclass in living off trusted infrastructure. OWAReaper polls GitHub's commit-search API once a day, looking for commit messages that contain the victim's email address; commands arrive AES-CTR-encrypted and cover toolkit replacement, C2 rotation, and arbitrary eval(). A backup channel reads commands straight out of incoming emails, polling the IndexedDB cache every five minutes. Exfil goes out over HTTPS proxied through legitimate image CDNs — weserv.nl, WordPress's i3.wp.com, slack-imgs.com — with DNS tunneling as a fallback. None of that trips an egress filter, because none of those destinations belong on a blocklist. This is the modern shape of C2: not a beacon to a sketchy VPS, but API calls to services your own developers depend on.

What to actually do

Patch CVE-2026-42897 first — that closes the door. But if TA488 was inside before May, patching evicts nobody, and that's the operational trap. Containment here is an authorization-hygiene exercise, not an identity-hygiene one:

• Audit Default-user folder permissions across mailboxes. Any Owner grant to Default is either a misconfiguration or this. Both need fixing.
• Enumerate Outlook add-ins with ReadWriteMailbox scope and revoke their EWS tokens. That permission is the pivot; treat it as privileged.
• Purge the client foothold: clear OWA's owa_offline_db IndexedDB store and the PageDataPayload.OwaUserDefaultSettings localStorage key on affected users. Re-imaging alone won't do it if the cache syncs back.
• Alert on the C2 pattern, not just the domains. Proofpoint's IOCs (acocdn[.]com, asecdns[.]com, and friends) will rotate; the durable signal is OWA sessions calling GitHub's commit-search API or POSTing to image CDNs.

The uncomfortable takeaway generalizes well beyond Exchange. As mail, identity, and collaboration collapse into browser-based apps backed by rich server-side permission graphs, the persistence surface moves with them. Delegations, OAuth grants, add-in scopes, mailbox rules, SPA cache — these are the new implants, and they don't show up in the tools built to find the old ones. TA488 didn't discover that; they just weaponized it cleanly. The question for every security team running cloud mail is whether their eviction playbook can even see an authorization object, let alone remove one. For most, right now, the honest answer is no.