Laundry Bear Uses “Half-Click” OWA Email Exploit

How the attack worked

The group tracked as Laundry Bear (TA488) sent emails from a series of compromised accounts, exploiting a vulnerability in Outlook Webmail. Simply opening the message in Outlook Web Access was enough: the Outlook Exchange server mishandled the HTML content of the message and executed arbitrary JavaScript. This is what researchers describe as a half-click technique, since it requires no link click, no attachment open, and no additional user interaction beyond viewing the email. That JavaScript executed a payload called OWAReaper, an implant built to maintain long-term access to a victim's mailbox.

Why it succeeded

Several factors made this campaign effective. First, targeting was unusually broad across government, telecommunications, finance, hospitality, and aerospace organizations, which likely helped the malicious emails blend into normal mass-mailing spam traffic rather than standing out as a targeted lure. Second, the messages came from compromised accounts rather than spoofed or unfamiliar senders, making them appear more legitimate to recipients who trust known contacts. Third, the core mechanism relies on a webmail vulnerability rather than user judgment, so the usual advice of avoiding suspicious links or attachments does not fully protect against it.

What to watch for

• Unexpected emails from real colleagues or vendors that do not match their usual tone or context, since their accounts may have been compromised
• Any indication that simply opening a message in Outlook Web Access caused unusual behavior, since no link click is required to trigger this exploit
• Repeated mailbox or account issues that persist even after password resets or full device re-imaging
• Unusual loading behavior or embedded content when viewing older emails from a webmail cache

Building resistance

Because OWAReaper can persist through a hidden iframe stored in OWA's offline IndexedDB message cache, reopening an older poisoned email can reinfect a mailbox even after cleanup efforts. Security teams should treat repeated post-remediation symptoms as a signal to investigate the mailbox and webmail layer itself, not just the endpoint device. Employees across all roles that use Outlook Web Access, including executives, finance staff, IT administrators, and general staff, should be encouraged to report anything unusual seen in webmail, even if they did not click on anything. Given the attack requires no interaction beyond opening a message, timely patching of the underlying webmail vulnerability and rapid incident response escalation are central to limiting exposure, alongside awareness that a compromised colleague account can be the source of a malicious email.

What is the Laundry Bear half-click attack?

It is a technique where opening an email in Outlook Webmail is enough to trigger malicious JavaScript execution, without the victim clicking any link or attachment.

What does the OWAReaper payload do?

OWAReaper is described as a highly sophisticated implant designed to maintain access to mailboxes, and it can persist even after credential rotation and full device re-imaging.

Why is this attack hard to remove?

OWAReaper can reinfect a device through a hidden iframe stored in OWA's offline IndexedDB message cache, so reopening an older poisoned email can trigger the exploit again.

Who is being targeted by this campaign?

Targeting was unusually broad across government, telecommunications, finance, hospitality, and aerospace sectors, likely to blend in with normal spam traffic.