Proofpoint uncovered the most sophisticated backdoor delivered via half‑click exploits – OWAReaper – and the group behind it, Laundry Bear, has been running it for weeks. The campaign targets the **Exchange OWA zero-day** (CVE‑2026‑42897) and lets attackers keep a foothold in a victim’s mailbox even after a clean image restore. That’s the catch.
Key Takeaways
- Laundry Bear is exploiting CVE‑2026‑42897 as a zero‑day in Outlook Web Access.
- The half‑click exploit only needs the user to open a crafted email – no attachments or links.
- OWAReaper can persist by hijacking Outlook add‑ins and injecting malicious iframes into IndexedDB.
- Two C2 channels are used, one of which uses GitHub commit messages.
- Changing credentials or reinstalling systems won’t evict the attacker.
Exchange OWA zero-day: How Laundry Bear weaponized CVE‑2026‑42897
Microsoft’s advisory on May 14 warned about the HTML sanitization flaw in OWA that lets JavaScript run when a user opens a malicious email. Proofpoint says the threat actor was already abusing the flaw a week before the advisory went public. That’s a clear sign the group built its infrastructure in March, almost two months ahead of Microsoft’s warning.
According to the report, the vulnerability stems from the server’s improper sanitization of HTML code in the message body. When the crafted email lands in the victim’s inbox, the malicious payload executes inside the browser context, giving the attacker full control of the OWA reading pane.
“The subject lines and lures are banal, likely so the targeted user opens and skims the message, but dismisses the message as junk without reporting it, especially given that there are no suspicious URLs or attachments present,” the researchers wrote.
Why the timing matters
Building the attack chain before Microsoft’s advisory suggests the group had a stable, long‑term operation. It also means defenders were blind to the exploit while it was already in the wild. That’s a concerning lag for any organization that relies on Exchange.
Half‑click exploit: why opening an email is enough
Proofpoint calls this a “half‑click exploit” because the victim only needs to open the email – no click, no download. The malicious code hides in a JavaScript loader and Base64‑encoded blobs embedded after the ‘#’ character in a social‑media‑icon URL. When the OWA page renders the email, the JavaScript runs automatically.
Because the payload lives entirely in the browser, there’s no binary on disk to flag. That makes traditional antivirus and endpoint detection tools practically blind. The exploit’s stealth is amplified by the fact that the email contains no overtly suspicious elements.
From ZimReaper to OWAReaper
Earlier this year, the same group used CVE‑2025‑66376 in Zimbra servers to drop ZimReaper, a malware that stole 2FA codes and passwords. OWAReaper is an evolution of that code‑base, now tuned for Outlook Web Access. The researchers describe it as “the most sophisticated backdoor delivered via half‑click exploits” they’ve seen.
OWAReaper’s persistence tricks that defy system wipes
Once executed, OWAReaper uses Outlook APIs to rewrite the original email on the Exchange server, erasing the exploit content. Simultaneously, it disables OWA pop‑ups and right‑click functionality, limiting the user’s ability to investigate the page.
Beyond that, the backdoor harvests the compromised account’s email address, username, and Outlook settings. It also creates invisible DOM elements to capture auto‑filled credentials, a subtle way to siphon passwords without user interaction.
Perhaps the most unsettling part is the long‑term persistence mechanism. OWAReaper checks for installed Outlook add‑ins that have **ReadWriteMailbox** permissions. It then steals OAuth tokens via the GetClientAccessToken request and calls UpdateFolder to grant itself Owner‑level permissions to the ‘Default’ user on every mail folder.
“It then calls UpdateFolder to grant itself Owner-level permissions to the ‘Default’ user (a low-permission preset alias in all Microsoft Exchange tenants) on every mail folder,” Proofpoint researchers explained.
Because mailbox permissions are stored server‑side, rotating credentials or reinstalling a workstation does nothing to revoke that access. The attacker can now read or send mail from any authenticated account in the tenant.
OWAReaper also injects a malicious iframe into the HTML of messages stored in OWA’s offline IndexedDB cache. This iframe fires each time the victim opens a poisoned email from the cache, ensuring the backdoor re‑activates even after a reboot.
“This iframe executes every time the victim opens a poisoned email from the cache,” the report notes.
Command‑and‑control channels: GitHub and beyond
The malware supports two C2 mechanisms. One of them queries GitHub’s Commit Search API every 24 hours for encrypted messages that match a specific format and include the target’s email address. That’s a clever way to blend malicious traffic with legitimate developer activity.
The second channel wasn’t detailed in the source, but the presence of multiple C2 paths makes takedown efforts harder. Using a public platform like GitHub also gives the attackers plausible deniability and makes detection more complex.
Implications for defenders
- Traditional email filters may miss the exploit because there are no malicious URLs or attachments.
- Endpoint tools that rely on file‑based indicators won’t see the JavaScript payload.
- OAuth token theft means attackers can move laterally without needing new credentials.
- IndexedDB persistence bypasses OS‑level restores.
What This Means For You
If you run Microsoft Exchange on‑premises or use Exchange Online, you need to verify that the HTML sanitization fix for **CVE‑2026‑42897** is applied immediately. Patch management isn’t optional; it’s the first line of defense against a half‑click exploit that requires no user interaction beyond opening an email.
Beyond patching, audit Outlook add‑ins for **ReadWriteMailbox** permissions and prune any that aren’t essential. Tighten OAuth token scopes and monitor for unexpected UpdateFolder calls. Finally, consider disabling OWA pop‑ups and right‑click functionality as a temporary mitigation until the vulnerability is fully remediated.
Developers building on Exchange should also review how their applications handle OWA content. Any custom web‑mail extensions that process HTML need strict sanitization and CSP headers. Ignoring these safeguards could turn a harmless‑looking email into a persistent foothold for a sophisticated threat actor.
As threat actors continue to weaponize web‑mail platforms, the line between a simple phishing email and a full‑blown breach is getting blurrier. Will organizations treat web‑mail vulnerabilities with the same urgency they give to ransomware vectors? Only.
Historical Context
OWA has been a high‑value target for attackers since its introduction. The platform’s web‑based nature makes it attractive: a single compromised browser session can give an adversary access to an entire mailbox. Over the past decade, Microsoft has issued multiple advisories for HTML‑related flaws, each prompting a wave of quick‑turn exploits. The current campaign sits on that legacy. By using a vulnerability disclosed in March, Laundry Bear demonstrated a willingness to wait for the perfect moment, a pattern that mirrors earlier incidents where threat actors let a zero‑day linger for weeks before activating it.
That patience is not new. In 2023, a separate group exploited a different OWA flaw to deliver a credential‑stealing payload. The key difference now is the half‑click delivery model. No link, no attachment—just a crafted email body. This evolution reflects a broader shift toward “living‑off‑the‑land” techniques, where attackers abuse native browser capabilities instead of dropping files. The transition from ZimReaper to OWAReaper illustrates that shift clearly: the same code‑base repurposed for a newer web‑mail environment, preserving the core theft mechanisms while adapting to the specifics of Exchange’s API surface.
Understanding this lineage helps security teams anticipate future variants. If a group can pivot from Zimbra to Exchange, it likely has the expertise to target other web‑mail services that rely on similar HTML rendering pipelines. The historical pattern suggests that once a vulnerability is disclosed, the window for exploitation expands dramatically as threat actors accelerate development of custom backdoors.
Competitive Landscape
While Laundry Bear is the only group publicly linked to OWAReaper, the tactics employed are shared across the underground. Other actors have published half‑click exploits against popular SaaS mail platforms, demonstrating that the approach is becoming a staple in the attacker toolkit. The use of public code‑hosting services for command and control is also a recurring theme. GitHub’s vast traffic volume provides a convenient cover for malicious beaconing, and its API makes it easy to retrieve small data payloads without raising suspicion.
In practice, this means defenders are not facing a single‑vendor problem. The same persistence tricks—such as injecting iframes into IndexedDB or abusing OAuth token scopes—appear in multiple threat reports. Organizations that have already hardened their environment against one variant will find themselves better positioned when another emerges. Conversely, a narrow focus on traditional malware signatures leaves a gap that these web‑centric backdoors can exploit.
Competitors also differ in how quickly they adopt new vulnerabilities. Some groups rush to weaponize a flaw within days of disclosure, while others, like Laundry Bear, invest weeks in building a resilient infrastructure. The latter approach often yields more sophisticated persistence, as seen in the ability to retain access after a full system restore. Recognizing which strategy a threat actor prefers can guide incident response priorities.
Key Questions Remaining
- How many organizations have already been compromised before the May 14 advisory was published?
- What detection gaps exist in current SIEM and EDR solutions for JavaScript that lives solely in the browser?
- Can the GitHub‑based C2 channel be reliably disrupted without affecting legitimate developer workflows?
- What is the realistic timeline for Microsoft to release a comprehensive mitigation that addresses both the HTML sanitization flaw and the OAuth token abuse vector?
Answers to these questions will shape the next wave of defenses. In the meantime, the safest path is to eliminate the attack surface wherever possible. Patch now. Audit permissions. Monitor for strange UpdateFolder activity. Those steps buy time while broader industry mitigations take shape.
Sources: BleepingComputer, Microsoft
