Half-Click OWA Emails Trigger Stealth Mailbox Takeover

How the attack worked

The TA488 group, also tracked as Void Blizzard or Laundry Bear, sent emails crafted to look like routine informational updates, including content about supply chains and market indicators. The key detail is that a recipient did not need to click a link or open an attachment. Simply viewing the message in Outlook Web Access was enough for embedded JavaScript to execute inside the browser's reading pane.

Once triggered, the code launched OWAReaper, a previously undocumented JavaScript implant. The implant runs inside the OWA reading pane, removes the exploit code from the stored message after execution, and can attempt to capture credentials through browser autofill. If a vulnerable Outlook add-in with ReadWriteMailbox permissions is present, OWAReaper can use it to obtain an OAuth token and modify mailbox permissions, creating durable, server-side access.

Why it succeeded

This attack succeeded because it removed the usual behavioral cues that awareness training focuses on: a suspicious link or an unexpected attachment. Since simply opening the message in OWA was sufficient, the interaction looked like normal email use. The bland, plausible content, styled as generic informational updates, gave recipients no obvious reason for suspicion.

The persistence mechanism also undermines standard incident response assumptions. Because mailbox permissions are stored server-side on Exchange, changing a victim's password or rebuilding their device does not remove attacker access. This means traditional response steps, such as resetting credentials and reimaging endpoints, may not be sufficient on their own.

What to watch for

• Unexpected messages framed as routine updates, such as supply chain or market briefs, with no clear reason for being sent
• No requirement to click a link or open an attachment for compromise to occur
• Unexplained mailbox permission changes following a suspicious email being opened
• Unusual OAuth token grants or Outlook add-in activity tied to a mailbox

Building resistance

Organizations should treat

What is a half-click OWA attack?

It is an exploit where simply viewing a crafted email in Outlook Web Access triggers malicious JavaScript, with no link click or attachment needed to execute the code.

How does OWAReaper maintain access after a password reset?

OWAReaper can modify mailbox permissions stored on the Exchange server itself, so resetting a password or rebuilding the endpoint does not remove that server-side access.

Which groups or sectors were targeted by this attack?

TA488, also known as Void Blizzard or Laundry Bear, targeted government and multiple commercial sectors including telecommunications, financial services, hospitality, and aerospace.

What should incident responders check if OWAReaper is suspected?

Responders should review mailbox permission changes, add-in activity, and OAuth token events for users who opened suspicious OWA messages, not just reset passwords and reimage devices.