A newly identified cyber-espionage campaign attributed to the advanced persistent threat (APT) group TA488 is exploiting CVE-2026-42897, a critical cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA) to deploy a sophisticated JavaScript-based backdoor known as OWAReaper.
The campaign was first observed on July 22, 2026, shortly before public reports from Proofpoint and the U.S. National Security Agency (NSA) highlighted the group’s evolving tactics.
Security researchers describe the operation as a significant advancement in browser-based malware, demonstrating how attackers are increasingly abusing trusted enterprise collaboration platforms to gain persistent access to sensitive environments.
TA488 Exploits Microsoft OWA XSS Flaw
According to threat intelligence findings, TA488 compromised legitimate email accounts to distribute carefully crafted phishing messages targeting organizations across the government, telecommunications, financial services, hospitality, and aerospace sectors.
Unlike conventional phishing attacks, these emails contained no malicious attachments, hyperlinks, or explicit call-to-action, making them significantly more difficult for users and email security solutions to identify.
Instead, the messages featured generic informational content with subject lines referencing topics such as semiconductor supply chains, global gas markets, nuclear energy developments, tourism statistics, and public health surveillance.
Researchers believe the campaign’s unusually broad targeting and high email volume were deliberate attempts to blend malicious traffic with ordinary business communications.
The attack relies on CVE-2026-42897, an XSS vulnerability caused by insufficient sanitization of HTML content rendered by Outlook Web Access.
When a recipient opens one of the malicious emails using a vulnerable OWA instance, attacker-controlled JavaScript executes directly within the authenticated browser session.
TA488 embedded an onload event handler inside the email that activates a lightweight JavaScript loader. Instead of storing the complete payload in a single location, the loader reconstructs encoded malware fragments hidden inside seemingly harmless social media icon elements embedded within the email body.
Although browsers ignore data placed after specific special characters in image attributes, the loader successfully extracts, reassembles, and executes the concealed payload, resulting in the deployment of the OWAReaper implant.
Researchers note that this modular approach is considerably more stealthy than the group’s previous ZimReaper campaigns targeting Zimbra webmail servers.
Once executed, OWAReaper operates entirely inside the Outlook Web Access reading pane without requiring any downloaded files or traditional malware binaries.
To minimize forensic evidence, the implant immediately overwrites the malicious email stored on the Exchange server, effectively removing traces of the original exploit.
During execution, it temporarily disables browser right-click functionality and suppresses pop-up windows to prevent users from noticing suspicious behavior.
The malware collects information including the victim’s email address, username, Outlook configuration, and mailbox settings before initiating additional credential theft activities.
One of OWAReaper’s most concerning capabilities is its abuse of browser autofill functionality. The malware creates hidden HTML input fields positioned outside the visible browser window and silently waits for password managers or browser autofill features to populate saved Outlook credentials.
Without displaying any authentication prompt, the implant captures usernames and passwords, allowing attackers to obtain valid enterprise credentials while remaining virtually invisible to the victim.
This stealth technique significantly increases the effectiveness of account compromise while avoiding many traditional phishing detection mechanisms.
To maintain persistence, OWAReaper stores an encrypted copy of itself within the PageDataPayload.
OwaUserDefaultSettings entry in the browser’s localStorage, a legitimate Outlook Web Access configuration area used during synchronization and restoration processes.
Every time the victim opens a new OWA session, the application’s normal synchronization workflow can reload the malicious code, enabling persistent reinfection without requiring another phishing email.
The malware also searches for Outlook add-ins possessing ReadWriteMailbox permissions, attempts to obtain OAuth access tokens through Exchange functions, and modifies mailbox folder permissions.
In some cases, it grants Owner-level access to the built-in Default user across mailbox folders, potentially allowing other authenticated users within the same organization to access sensitive email content.
Security teams are strongly advised to immediately patch vulnerable OWA deployments, monitor mailbox permission changes, disable unnecessary add-ins, review browser localStorage artifacts, and implement continuous threat detection to identify indicators associated with the OWAReaper campaign.
No Comment! Be the first one.