CVE-2026-42897 (CVSS 8.1): Laundry Bear’s OWAReaper Lives Inside Your Mailbox — Survives Password Reset and Complete Device Rebuild

Imagine this: your IT team resets every password in the organisation. You wipe every laptop. You rebuild every workstation from bare metal. And when the dust settles, a Russian intelligence group still has full read-write access to your CEO’s inbox — because their implant is not sitting on any device at all. It is living inside the mailbox itself.

That is the reality of CVE-2026-42897, a CVSS 8.1 cross-site scripting vulnerability in Microsoft Exchange’s Outlook Web Access (OWA), actively weaponised since at least May 2026 by the Russian state-sponsored threat actor known as Laundry Bear (also tracked as Void Blizzard, TA488, and CL-STA-1114). The group’s custom JavaScript implant — OWAReaper — represents a generational leap in email-based espionage: a backdoor that survives credential rotation, multi-factor authentication, and a complete device rebuild, because its foothold is in the Exchange store, not on Windows.

If your organisation runs on-premises Exchange Server 2016, 2019, or the Subscription Edition and has not applied the June 2026 security update, you are exposed. If you have patched but never hunted for IOCs, you may already be compromised — OWAReaper is explicitly designed to erase its delivery traces from the server-side mail store.

What Is CVE-2026-42897 and Why Is OWAReaper Different?

CVE-2026-42897 is a stored cross-site scripting vulnerability in Microsoft Exchange’s webmail interface. The root cause is improper sanitisation of HTML in message bodies: when a victim opens a malicious email in OWA, the Exchange server fails to strip attacker-controlled JavaScript from the message, allowing that script to execute in the victim’s authenticated browser session against the Exchange domain.

What makes the attack particularly insidious is the “half-click” delivery model. There is no malicious link to lure the victim into clicking. Simply opening the email is enough. Laundry Bear sends messages from previously compromised accounts and Proton Mail addresses, using innocuous-sounding lures — supply-chain analysis updates, tourism metrics, gas-market research — content generic enough to slip past user suspicion and bulk-email classifiers alike.

Previous exchange-targeted malware planted payloads on the endpoint. OWAReaper does something far more elegant and far more dangerous: it plants its persistent state in the Exchange message store itself. Two persistence channels ensure it survives almost any remediation step:

1. Browser localStorage: An encrypted copy of the implant payload is stored in OWA’s localStorage, tied to the Exchange domain — not to any individual device profile. When the victim logs in on any device, the cached payload reactivates.
2. Offline IndexedDB message cache: Hidden iframes inject the backdoor into OWA’s offline message cache, meaning it survives browser restarts, cache clears, and — critically — complete device rebuilds, because the infected data lives on the Exchange server, not on the client.

To erase its own tracks, OWAReaper automatically rewrites the original delivery email on the Exchange server, removing all exploit code and replacing the body with innocuous content. By the time a forensics team goes looking for the smoking gun, the original phishing email no longer exists in the mail store.

Inside the OWAReaper Attack Chain: A Technical Breakdown

Proofpoint’s threat intelligence team, which first exposed the campaign in late July 2026, documented the following kill-chain:

Stage	Mechanism	Purpose
1. Delivery	Crafted HTML email from compromised or Proton Mail account	Delivers exploit to victim’s inbox
2. Trigger	onload= event handler; Base64 fragments assembled from social-media icon HTML and text after # anchors	Executes JavaScript in OWA context on email open — no click required
3. Credential harvest	Browser autofill scraping; username, email, Outlook settings extraction	Initial credential exfiltration
4. OAuth token theft	ReadWriteMailbox-enabled Outlook add-in installation; token extraction	Grants persistent API-level mailbox access independent of password
5. Privilege escalation	Owner-level mailbox permission granted across the organisation	Lateral access to other mailboxes without re-exploitation
6. C2 polling	GitHub Commit Search API queried every 24 hours for AES-CTR-encrypted commands in commit messages	Covert command delivery blending into developer traffic
7. Secondary C2	Inbound emails parsed for Base64-encoded commands addressed to victim	Out-of-band command channel if GitHub is blocked
8. Exfiltration	HTTPS with AES-CTR-encrypted URI paths; DNS label tunnelling as fallback; CDN proxying	Data exfiltration bypassing perimeter controls
9. Cover-up	Delivery email body rewritten on Exchange server; OWA pop-ups and right-click functionality disabled	Erase forensic artefacts; suppress victim awareness

The use of GitHub’s Commit Search API as a covert C2 channel is a particularly noteworthy tradecraft choice. Queries to api.github.com blend seamlessly into developer network traffic, are rarely blocked by enterprise proxies, and leave no easily correlated indicator in standard SIEM rules. Defenders looking for C2 beaconing to suspicious IPs or domains will miss it entirely.

Who Is Laundry Bear?

Laundry Bear (officially tracked as Void Blizzard by Microsoft and as TA488 by Proofpoint) is a Russian state-affiliated espionage group assessed to operate on behalf of Russian intelligence interests. The group first came to prominence with ZimReaper — a functionally similar browser implant that targeted Zimbra servers by exploiting CVE-2025-66376, a Zimbra XSS flaw, from July 2025 onward.

After a quiet period from February to late July 2026, Laundry Bear re-emerged with OWAReaper, pivoting from Zimbra to Microsoft Exchange — dramatically expanding its potential victim pool. Microsoft disclosed CVE-2026-42897 on 14 May 2026 (two days after May Patch Tuesday) and CISA immediately added it to the Known Exploited Vulnerabilities (KEV) catalog on 15 May 2026, mandating that Federal Civilian Executive Branch agencies apply mitigations by 29 May 2026.

Targeted sectors in this campaign span US and European government entities, telecommunications operators, financial services firms, hospitality organisations, and aerospace companies. Given the group’s previous interest in South Asian policy matters, Indian government ministries, defence contractors, and telecom operators should treat this threat with particular urgency.

What You Should Do Right Now — Sanjay Seth’s Defence Playbook

In 30 years of working with organisations across India on network security and zero-trust architecture, the most expensive failures I have seen share a common thread: organisations that patched the vulnerability but never asked whether they were already compromised. With OWAReaper, that mistake is catastrophic. Here is what I recommend:

1. Apply the June 2026 Exchange Security Update immediately. CVE-2026-42897 was patched on 9 June 2026. If you are still running the May 2026 or earlier CU, you are actively vulnerable. For environments where patching requires change-control approval cycles, deploy the EEMS mitigation (ID M2.1.x) via the Exchange Emergency Mitigation Service today — it applies automatically for Exchange 2016, 2019, and SE.
2. Hunt for OWAReaper IOCs regardless of patch status. Because the backdoor erases its delivery email, standard log analysis will not find it. Look for:
   • Unexpected or newly created Outlook add-ins with ReadWriteMailbox permissions on any mailbox
   • Mailbox permission changes granting Owner-level access to unexpected accounts
   • Outbound HTTPS flows from Exchange servers to api.github.com (Commit Search endpoint) not initiated by DevOps tooling
   • DNS queries containing unusually long subdomain labels (indicative of DNS tunnelling fallback)
   • Emails in staff inboxes that appear blank or contain only a forwarded footer — these may be rewritten delivery vehicles
3. Audit OAuth token grants and Outlook add-in inventory. OWAReaper steals OAuth tokens via add-in installation, which means password resets alone will not evict the attacker. Revoke all non-approved add-ins and refresh all OAuth grants.
4. Restrict OWA exposure at the perimeter. If your Exchange OWA is internet-facing (and if you are an Indian enterprise, odds are very high it is), place it behind a zero-trust web application proxy with continuous identity verification — one that can inspect OWA sessions for anomalous JavaScript execution patterns. FortiGate’s application-layer inspection with deep-packet analysis for Exchange traffic is a reliable first line here.
5. Block or alert on GitHub Commit Search API queries from non-developer subnets. Your Exchange servers have no legitimate reason to be querying api.github.com/search/commits. A single firewall rule or CASB alert covers this C2 channel entirely.
6. Evaluate a move to Exchange Online / Microsoft 365. Microsoft’s cloud-hosted Exchange benefits from server-side patches that deploy without change-control cycles and from Microsoft Defender for Office 365’s real-time anti-exploit signatures. For organisations still running on-premises Exchange, this incident should accelerate that conversation.

Frequently Asked Questions

We use Microsoft 365 / Exchange Online, not on-premises Exchange. Are we at risk?

CVE-2026-42897 specifically affects on-premises Exchange Server 2016, 2019, and the Subscription Edition. Microsoft 365 / Exchange Online received server-side mitigations before public disclosure and is not affected by this vulnerability. However, organisations with hybrid Exchange deployments — where on-premises Exchange relays email for Microsoft 365 mailboxes — should patch the on-premises component regardless, as it remains a potential exploitation entry point for email traversing the hybrid connector.

We applied the June 2026 CU but never checked for IOCs. How do we know if we were compromised before we patched?

Start with your Exchange Message Tracking Logs and audit the MailboxPermissionAdded events in your Exchange audit log for the period March–June 2026. Pull a report of all Outlook add-ins installed organisation-wide and cross-reference against your approved software list. Engage a specialist threat-hunting team to analyse browser localStorage contents on OWA endpoints and inspect offline IndexedDB caches — standard EDR tools will not surface these artefacts automatically.

How does OWAReaper survive a complete device rebuild if it’s a JavaScript implant?

The key insight is that OWAReaper’s persistence lives on the Exchange server, not the client. By injecting payload data into OWA’s offline IndexedDB message cache — which is synchronised from and maintained by the Exchange server — the backdoor reloads from the server-side store every time the victim logs back into OWA, regardless of what device they use. A device rebuild removes the local copy; the server-side copy pushes a fresh instance the next time the user checks their email in a browser.

Is this an Indian government-specific threat or a global concern?

Laundry Bear’s publicly documented target list focuses on US and European government, telecom, and aerospace, but the group’s operational pattern — and Russian intelligence priorities in South Asia — make Indian government ministries, defence-sector organisations, and critical infrastructure operators high-probability secondary targets. Indian Computer Emergency Response Team (CERT-In) has not yet issued a specific advisory as of this publication, but Indian IT leaders should not wait for one: apply the patch and hunt for IOCs now.

---

The zero-trust principle of “never trust, always verify” was designed precisely for attacks like OWAReaper — threats that compromise identity at the source and make perimeter defences irrelevant. If your security architecture still assumes that a valid credential equals a trusted user, you are one malicious email open away from persistent, invisible espionage access that no password reset can undo.

At P J Networks, Sanjay Seth and his team specialise in designing zero-trust architectures that break exactly these kill-chains — from OWA session monitoring to FortiGate perimeter enforcement and Exchange hardening for Indian enterprises. If you would like a confidential assessment of your Exchange security posture or your organisation’s exposure to the OWAReaper campaign, reach out for a security assessment today. Threats at this level of sophistication demand expertise at the same level.