A Russian threat group has exploited a cross-site scripting flaw in Microsoft Exchange to compromise email accounts at government agencies and private companies across the United States and Europe. The campaign, attributed to TA488 (also known as Void Blizzard and Laundry Bear), began on July 22, 2026, and targeted organizations in telecommunications, finance, hospitality, and aerospace sectors, according to cybersecurity firm Proofpoint.
The attackers exploited CVE-2026-42897, a vulnerability caused by inadequate HTML sanitization in email bodies. Recipients did not need to click links or open attachments; simply viewing a specially crafted message in Outlook Web Access triggered malicious JavaScript execution within the browser. Microsoft disclosed this vulnerability on May 14, 2026, and released an emergency mitigation before issuing a complete code fix in June. The flaw affects Exchange Server 2016, 2019, and Subscription Edition, but not Exchange Online.
The attack deploys OWAReaper, a previously unknown JavaScript implant that operates within the OWA reading pane. After execution, the malware removes exploit code from the stored message to hide evidence from users and investigators. OWAReaper collects account information and attempts to capture credentials through browser autofill. If it discovers an Outlook add-in with ReadWriteMailbox permissions, the malware can obtain an OAuth token and grant owner-level access to Exchange's built-in Default identity, allowing attackers to maintain access even from other authenticated accounts within the organization.
The persistence mechanism represents a significant challenge for incident response teams. Because the attacker establishes permissions directly on the Exchange server rather than just compromising an endpoint, standard remediation steps like password resets, token revocation, and device reimaging will not remove the threat. Traditional security tools focused on endpoint files or processes may fail to detect an implant operating inside a browser session, and email security controls struggle because delivery messages contain no obvious malicious attachments or conventional phishing links.
Organizations should immediately apply Microsoft's July 2026 Exchange security update if not already deployed. Security teams must treat these incidents as server-side identity compromises rather than simple endpoint infections. Recommended detection approaches include identifying users who opened suspicious OWA messages, reviewing subsequent mailbox permission changes, monitoring add-in activity and OAuth events, and examining browser storage artifacts. Investigators should implement cross-layer correlation that connects OWA session activity with permission modifications and authentication events to identify compromised accounts.
Source: https://www.csoonline.com/article/4203349/russian-hackers-turn-exchange-flaw-into-half-click-mailbox-takeover.html
Focusing on the persistence of these actors highlights how identity and session management have become the primary battleground for modern defense. When attackers bypass traditional perimeter controls through refined exploitation of common services, the traditional alert model fails because the activity looks entirely legitimate to the system. We need to shift our focus toward behavioral telemetry that identifies the intent behind the session rather than just the initial entry point. By mapping the subtle deviations in how a user interacts with their mailbox after the initial compromise, we can catch the activity that remains invisible to standard security tools. This is the next logical step for teams moving beyond simple detection.
https://cyrilsimonnet.substack.com/p/there-was-nothing-to-detect-that