A Russia-linked group (TA488) abused a stored XSS flaw in on‑prem Microsoft Exchange Outlook Web Access (OWA) so that simply opening a specially crafted HTML email could run attacker JavaScript inside the victim’s logged-in webmail session. The campaign used business-themed subject lines and hid the exploit in seemingly harmless embedded images, leading to long-lasting mailbox access by stealing tokens/credentials and changing mailbox permissions for persistence.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You know that “safe” feeling of just opening an email in Outlook Web Access? For CVE-2026-42897, that’s all it takes. This is a “half-click” OWA exploit: opening a businessy email about pipelines or global gas markets silently runs attacker JavaScript hidden in an image tag. Their OWAReaper code lives in your browser, skimming mailbox data, OAuth tokens, even changing mailbox permissions so Default suddenly has Owner access, surviving password changes. If you see a generic, metrics-heavy email in OWA that feels out of place, especially HTML with lots of icons, don’t just read it, hit Phish Alert and report it immediately.
Russian-linked threat actors sent generic-looking informational emails that required no clicking, but simply opening them in vulnerable Outlook Web Access (OWA) could trigger a hidden exploit. The campaign targeted government and multiple industries, then installed a stealthy browser-based implant…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Government agencies and security firms warn that Russia-aligned hackers are using “zero-click” phishing emails to compromise organizations using Zimbra webmail. The attack hides a malicious JavaScript payload inside an email so it runs when the message is opened, aiming to steal recent email,…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
A real phishing campaign targeted Call of Duty Mobile players by promising free in-game currency. Victims were tricked into entering their email and password, then providing a 2FA code on a follow-up page, enabling attackers to take over accounts.
Proofpoint reports a Russia-aligned espionage group (TA488) returned with a campaign that compromises on‑premises Outlook Web Access simply when a user opens an email in the reading pane. The attack uses a cross-site scripting flaw to run hidden JavaScript, install a browser-resident implant, and…
