“No-Action” Emails Trigger OWA Mailbox Takeover

How the attack worked

This campaign relied on a “half-click” exploit chain: opening or viewing an email in a vulnerable version of Outlook Web Access (OWA) was enough to trigger compromise, no clicking required beyond reading the message. The emails were deliberately vague, labeled as informational updates with wording like "no action required," and mimicked harmless content such as supply chain analyses, research updates, or tourism and gas market metrics. None of the messages contained links or attachments, which removed the usual visual cues defenders and filters look for.

Once a recipient opened the email in a vulnerable OWA session, the flaw tracked as CVE-2026-42897 delivered a browser-based implant referred to as "OWAReaper." This implant was designed for persistence and mailbox takeover, and it was built to survive normal remediation steps like password resets or reimaging the affected device.

Why it succeeded

The approach succeeded because it removed the traditional "tell" that awareness training focuses on: suspicious links or attachments. By excluding both, the messages felt low-risk and were more likely to be opened and skimmed rather than deleted or reported. The generic, mass-mailing style of the lures also helped the emails blend into ordinary spam rather than stand out as a targeted threat, letting the campaign reach a broad set of organizations across government, telecommunications, financial services, hospitality, and aerospace sectors.

What to watch for

• Emails that describe themselves as informational and explicitly state no action is required, especially when the topic is vague or irrelevant to your role.
• Messages from unexpected senders, including previously compromised addresses or unfamiliar external senders, that read like a generic bulletin you never subscribed to.
• Any unusual mailbox behavior after opening a webmail message, since browser-based implants like this one can persist even after a password change.

How to build resistance

Security teams should reinforce that the absence of links or attachments does not make an email safe, particularly on unpatched webmail platforms. Staff using OWA, government and contractor personnel, and teams in finance, telecommunications, and aerospace should be encouraged to report vague "no action required" emails rather than dismiss them as harmless spam. Incident response processes should also account for server-side persistence, meaning suspected compromises require deliberate removal from the Exchange server rather than relying solely on credential rotation or device rebuilds.

What is a half-click exploit?

It is an exploit where simply opening or viewing an email in vulnerable webmail is enough to trigger compromise, without the recipient clicking any link or attachment.

Why did these emails have no links or attachments?

Attackers intentionally excluded links and attachments so the message would look harmless and legitimate, increasing the chance the recipient would open and read it, which alone fired the exploit.

Does resetting a password remove the attacker after this exploit?

No. This persistent access lives on the server side, so credential rotation and even full re-imaging of the targeted device will not evict the actor without deliberate removal from the Exchange server.

Who was targeted in this campaign?

Targets included U.S. and European government entities and organizations in telecommunications, financial, hospitality, and aerospace sectors.