TA488 Uses “Half-Click” OWA Emails to Persist

How the Attack Worked

TA488, also tracked as Void Blizzard or Laundry Bear, resumed activity after a period of dormancy with a campaign targeting organizations that rely on on-premises Outlook Web Access. The emails exploited a cross-site scripting flaw, CVE-2026-42897, affecting on-premises Exchange Server rather than Exchange Online. Opening the email in a vulnerable OWA client caused the victim's browser to execute embedded JavaScript within their authenticated session, meaning no link click or attachment download was required to trigger compromise.

Once active, the implant, known as OWAReaper, lived inside the OWA reading pane. It hid itself in browser localStorage under a legitimate-looking settings key and used offline cache and IndexedDB tricks to re-infect sessions. Commanding relied on GitHub commit messages and inbound email polling, while exfiltration used HTTPS through legitimate image CDNs, with DNS tunneling available as a fallback.

Why It Succeeded

The lures were deliberately unremarkable, using ordinary business topics such as semiconductor supply chains, gas markets, and tourism metrics. This banality was likely intentional: recipients opened and skimmed the message, then dismissed it as junk without reporting it, since there were no suspicious links or attachments to flag. Because the exploit fired simply from opening the email in a vulnerable OWA client, standard user caution around links and attachments offered no protection.

The most durable part of the attack was server-side. It granted Exchange's low-privilege Default user Owner-level permissions on every mail folder, effectively opening the mailbox to any authenticated account in the organization. Because this permission grant lived on the server and required deliberate removal from Exchange, credential rotation and device re-imaging did not evict the actor.

What to Watch For

• Unexpected, low-urgency "business update" emails that encourage skimming rather than action
• Emails opened in on-premises OWA where reading-pane rendering could be exploited if systems are unpatched
• Unexplained changes to mailbox folder permissions, particularly involving Default user access grants
• Unusual outbound traffic to image CDNs or DNS tunneling activity following email access

Building Resistance

Organizations should train employees to report suspicious or irrelevant emails even when no links or attachments are present, since boring-looking messages can still carry risk. IT and security teams should prioritize patching on-premises Exchange and OWA systems, since simply opening an email in webmail can trigger compromise on unpatched deployments. Security operations teams should also conduct regular audits of Exchange mailbox folder permissions, since server-side persistence mechanisms can survive password resets and re-imaging, requiring deliberate removal at the Exchange configuration level rather than relying on credential changes alone.

Did the victim need to click a link for TA488's attack to work?

No. Simply opening the email in a vulnerable on-premises OWA client caused the browser to execute embedded JavaScript within the victim's authenticated session, with no link or attachment needed.

Does resetting passwords remove TA488's access?

No. The attack granted server-side mailbox folder permissions through Exchange's Default user permission settings, so credential rotation and device re-imaging did not remove the intruder's access.

Which systems were vulnerable to this attack?

The campaign exploited CVE-2026-42897, a cross-site scripting flaw affecting on-premises Exchange Server and Outlook Web Access, not Exchange Online.

Why were the phishing emails hard to detect?

The lures used deliberately boring, plausible business topics like semiconductor supply chains, gas markets, and tourism metrics, so recipients skimmed and dismissed them as junk rather than reporting them.