On July 22, 2026, Proofpoint saw a wave of malicious emails that weaponized a fresh OWA exploit — CVE-2026-42897 — to keep a foothold in victims’ mailboxes even after credentials were rotated. That’s the headline, but the details are far more unsettling.
Key Takeaways
- TA488 is using a half‑click XSS flaw (CVE-2026-42897) in Microsoft Outlook Web Access.
- The chain drops a new JavaScript implant called OWAReaper that survives credential changes.
- Proofpoint links the campaign to the same group behind the Zimbra XSS attacks of 2025‑2026.
- Targets span U.S. and European government agencies, telecoms, finance, hospitality, and aerospace.
- The malware rewrites emails via Exchange, steals OAuth tokens, and grants Owner‑level mailbox rights.
Historical Context
Outlook Web Access, or OWA, has been a staple of enterprise communication since the early 2000s. It provides a browser‑based front end to Microsoft Exchange, letting users read, compose, and manage mail from any device. Because the interface runs inside a web browser, it inherits the same attack surface as any modern web app: HTML parsing, JavaScript execution, and DOM manipulation.
Cross‑site scripting (XSS) has long been a concern for web‑mail platforms. In 2019, a public disclosure highlighted a reflected XSS bug in OWA that allowed an attacker to inject a script into the reading pane. Microsoft issued a patch, but the underlying pattern—embedding user‑controlled data into the page without proper encoding—remained a risk.
The group now known as TA488 first demonstrated a half‑click technique in the July‑2025 Zimbra campaign. That operation exploited CVE-2025-66376, a flaw in Zimbra’s Classic UI, and delivered a payload named ZimReaper. The success of that campaign showed that a single click—or even no click at all—could be enough to compromise a mailbox.
Building on that playbook, the attackers turned their attention to Microsoft’s ecosystem. The new CVE‑2026‑42897 vulnerability mirrors the earlier Zimbra bug but uses a different entry point: the onload attribute in OWA’s HTML. By chaining the half‑click approach with a more sophisticated persistence layer, the group has raised the stakes for organizations that rely on OWA for daily operations.
How the OWA exploit Works: A Step‑by‑Step Breakdown
The attack starts with a seemingly innocuous email sent from a compromised or fresh Proton Mail address. The message mimics a supply‑chain analysis or a tourism‑metrics report — no links, no attachments, just plain text. When the recipient opens the email in OWA, the embedded XSS payload fires automatically.
Half‑Click Mechanics
Proofpoint researchers explained, “TA488 is doubling down on the use of ‘half‑click’ exploits – where opening the email is enough to trigger compromise – with significantly improved loading mechanisms, techniques, and malware, signaling an improvement in the group’s tradecraft and capability.” The exploit uses the onload= event handler to parse a Base64‑encoded fragment hidden in the HTML’s social‑media icons. The fragment assembles into a JavaScript payload that runs in the browser.
That’s the catch. No user interaction beyond opening the message is required, which makes the attack blend in with mass‑mailing spam. Once triggered, the payload drops OWAReaper, a browser‑based implant designed for persistence.
Why the onload Event Matters
The onload attribute fires as soon as the browser finishes parsing the element. By placing the malicious code there, the attacker sidesteps any click‑based defenses that rely on user vigilance. The payload is executed in the context of the OWA page, inheriting the same permissions as a legitimate user session.
Because OWA renders emails inside an iframe, the script can reach the parent document once the iframe loads. This gives the implant the ability to read and modify mailbox contents without ever leaving the victim’s browser.
Microsoft’s own documentation notes that inline event handlers are a common source of XSS. The exploit therefore targets a well‑known weakness, but it does so with a level of obfuscation that evades many signature‑based scanners.
From ZimReaper to OWAReaper: Evolution of a Malware Family
Proofpoint traced the lineage back to the July‑2025 campaign that exploited CVE-2025-66376 in Zimbra’s Classic UI. That earlier attack delivered a JavaScript payload dubbed ZimReaper, which harvested 90 days of mail and other data. The new OWAReaper shares significant source code with ZimReaper, but it adds several capabilities tailored to Microsoft’s webmail client.
Persistence Mechanisms
After execution in the OWA reading pane, OWAReaper rewrites the original email on the Exchange server, stripping out the exploit code to hide its tracks. It also disables OWA pop‑ups and right‑click menus, making the malicious UI less obvious. The implant then creates two invisible input elements in the DOM, letting it capture saved OWA credentials via the browser’s autofill feature.
Next, it writes an encrypted version of itself plus a decryption wrapper into the browser’s localStorage. That means every time the user opens an OWA tab, the malware re‑executes without needing to re‑infect the mailbox.
Technical Architecture of OWAReaper
OWAReaper is composed of three logical modules. The first module is the loader, injected via the onload event. It decodes the Base64 fragment, verifies the integrity of the payload, and injects the second module into the page.
The second module is the persistence engine. It employs two techniques: DOM injection of hidden inputs and localStorage persistence. The hidden inputs intercept any future credential autofill events, while the localStorage entry ensures the script survives browser restarts.
The final module is the exfiltration component. It scans the Exchange environment for OAuth tokens tied to Outlook add‑ins, upgrades those tokens to Owner‑level access, and then uses the Exchange Web Services (EWS) API to read, modify, or forward messages. All communications with the command‑and‑control server are encrypted, making network‑level detection difficult.
Each module is designed to be lightweight. The entire script stays under 30 KB, which helps it blend in with legitimate web assets. Its small footprint also reduces the chance of triggering size‑based alerts in endpoint protection platforms.
Stealing OAuth Tokens and Gaining Owner‑Level Access
OWAReaper scans for installed Outlook add‑ins that have ReadWriteMailbox permissions. If it finds any, it harvests their OAuth tokens and upgrades its own permissions to Owner level on every mail folder. The researchers noted, “This is a key aspect of the infection chain; if TA488 has access to other accounts in the organization, the group maintains persistent access to the target’s mailbox.” That persistent server‑side access survives even if the compromised user changes passwords.
In practice, the group can now read, delete, and forward any email across the organization, effectively turning the entire Exchange environment into a surveillance platform.
Scope of the Campaign and Target Selection
Proofpoint says the volume of phishing messages and breadth of targeting marks a departure from previous TA488 operations, which tended to focus on smaller, more specific campaigns. This time, the group aims to blend in with broad spam, using generic lures like “research update” or “gas market metrics” to increase open rates.
- Start date: July 22, 2026
- Vulnerability: CVE-2026-42897 (CVSS 8.1)
- Earlier related flaw: CVE-2025-66376 (exploited since July 2025, patched ~Nov 2025)
- Payload: OWAReaper (browser‑based JavaScript implant)
- Data exfiltrated: up to 90 days of mail per victim (from ZimReaper legacy)
The campaign hits U.S. and European government entities, telecom operators, financial services, hospitality chains, and aerospace firms. That spread suggests a strategic aim to compromise high‑value communications across sectors that rely heavily on OWA.
Defensive Recommendations for Organizations
Microsoft has already patched CVE-2026-42897, but many enterprises still run older OWA versions that remain vulnerable. Proofpoint advises immediate patching, disabling auto‑complete for OWA credentials, and monitoring for the characteristic Base64‑encoded payloads in email bodies.
Security teams should also audit Outlook add‑ins for excessive permissions, enforce MFA for all mailbox access, and regularly rotate OAuth tokens. Detecting the unusual creation of invisible DOM inputs can be a tell‑tale sign of OWAReaper activity.
What This Means For You
If you’re a developer building on Microsoft Exchange or OWA, you now have to assume that any user who opens an email could be delivering a malicious script that persists beyond a password change. That means you can’t rely on credential rotation alone to cut off an attacker; you need to enforce strict client‑side sanitization and consider Content‑Security‑Policy headers that block inline scripts.
For security architects, the lesson is clear: half‑click exploits bypass traditional user‑training defenses. You must augment phishing awareness with technical controls that block or sandbox inline JavaScript in webmail clients. Continuous monitoring for unusual OAuth token usage and localStorage writes will help spot OWAReaper early.
IT administrators should verify that every OWA endpoint runs the latest patch level. Legacy servers are a soft target for this kind of attack. Regularly reviewing add‑in manifests for unnecessary permissions can close the token‑theft vector before it’s exploited.
For incident responders, the presence of invisible DOM elements and encrypted localStorage entries should trigger an immediate containment workflow. Isolate the affected mailbox, force a token revocation, and scan the browser profile for remnants of the implant.
Will defenders be able to stay ahead of TA488’s evolving half‑click tactics, or will the group continue to weaponize webmail quirks to infiltrate critical infrastructure? Only.
Key Questions Remaining
- How quickly will enterprises retire legacy OWA deployments that cannot be patched?
- Can Microsoft introduce runtime mitigations that neutralize
onload-based payloads without breaking legitimate functionality? - What detection signatures will threat‑intelligence platforms develop to flag the specific Base64 patterns used by OWAReaper?
- Will future variants move beyond JavaScript and embed native code to evade browser‑based defenses?
- How will the broader security community share remediation playbooks without exposing additional details to the adversary?
Sources: The Hacker News, SecurityWeek
