Laundry Bear Hackers Exploit Outlook Web Access Zero-Day for Stealthy Mailbox Access

Proofpoint has reported a new campaign by the group Laundry Bear (also known as Void Blizzard, and tracked internally by Proofpoint as TA488). According to the researchers, the attacks target government bodies in the United States and Europe, as well as companies in the telecommunications, financial, hospitality and aerospace sectors.

“Half a click” to infection

At the core of the attack is CVE-2026-42897, a vulnerability in Outlook Web Access — a cross-site scripting flaw that allows arbitrary JavaScript to run in the victim's browser. The cause is improper server-side sanitization of the HTML in the message body. Proofpoint's specialists call attacks like this a “half-click exploit”: the user only has to open the message, with no need to click any attachments or links.

Microsoft issued an advisory about the problem on May 14, but Proofpoint estimates that the attackers had set up the campaign's infrastructure back in March — nearly two months earlier — meaning they exploited the flaw as a zero-day. Earlier, the same group used a similar XSS in Zimbra servers to deliver the ZimReaper malware.

The emails are deliberately mundane in appearance — with subject lines like supply-chain analyses, research briefs, or figures on the tourism and gas markets. The bet is that the recipient will skim the message, dismiss it as spam and not report it: there really are no suspicious links or attachments in the email.

OWAReaper: covers its tracks and stays for the long haul

The researchers call the delivered backdoor, OWAReaper, the most sophisticated sample of its class they have seen. It operates entirely within the OWA mail-reading area: immediately after launch it uses the Outlook API to rewrite the message on the server, erasing the traces of the exploit, and it disables tooltips and the context menu while it runs. The malware collects the address, username and Outlook settings, and also tries to capture credentials by creating invisible elements in the DOM in the hope that the browser will autofill them.

The worst part is the persistence mechanisms. OWAReaper locates installed Outlook add-ins with ReadWriteMailbox permissions and uses them to steal OAuth tokens, after which it grants the “Default” account owner rights over all folders in the mailbox. Because these permissions are configured on the server side, neither changing the victim's password nor reinstalling the system from a clean image revokes the attackers' access. In addition, the malware injects a malicious iframe into messages cached in the offline IndexedDB database.

Communication with the operators is well thought out too: one command channel uses GitHub commit messages — once a day the malware searches through the Commit Search API for encrypted commands containing the victim's address. There are also fallback exfiltration paths, right down to tunneling over DNS.

Proofpoint has published a small set of indicators of compromise. The researchers base their attribution to TA488 on overlaps with prior ZimReaper activity and on a characteristic signature — XSS attacks on webmail for the purposes of espionage.

Source: Bleeping Computer