Loading malware…
OWAReaper is a browser-resident JavaScript backdoor used by the Russia-aligned cyberespionage group TA488, also known as Void Blizzard and Laundry Bear. It is an evolution of the group’s ZimReaper implant and operates within authenticated on-premises Microsoft Outlook Web Access sessions rather than deploying conventional endpoint files. It has been delivered through half-click exploitation of CVE-2026-42897, a stored cross-site scripting vulnerability in Outlook Web Access: opening a crafted email in a vulnerable session executes the implant without requiring a link click, attachment, or macro.
OWAReaper collects mailbox metadata, user identity and Outlook configuration information, and attempts to capture browser-autofilled credentials through hidden form elements. It identifies Outlook add-ins with ReadWriteMailbox permissions and can abuse them to acquire OAuth access tokens. The implant can modify Exchange folder permissions to grant Owner access to the built-in Default user, creating server-side mailbox persistence that can remain after password resets or device reimaging. Additional persistence is achieved through OWA browser storage and poisoned offline message-cache content, enabling re-execution in new OWA sessions or when cached messages are reopened.
The backdoor removes exploit material by rewriting the initially compromised email, receives encrypted commands through public GitHub commit messages and specially formatted inbound email, and supports toolkit replacement, command-and-control rotation, and arbitrary JavaScript execution. It exfiltrates encrypted information over HTTPS through image-content delivery services and can use DNS tunneling as a fallback. Observed targeting included government entities in the United States and Europe and organizations in telecommunications, finance, hospitality, and aerospace.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
OWAReaper est un implant JavaScript résident en mémoire navigateur, évolution du ZimReaper ciblant précédemment Zimbra.
TA458 and Void Blizzard exploited the “Half-click” vulnerability in Zimbra, Outlook Web Access, Roundcube, and SOGo to use ZimReaper and OWAReaper to collect credentials, contacts, and emails, and establish long-term persistence.
The new wave of exploitation revolving around CVE-2026-42897 culminates with the deployment of a previously unknown JavaScript browser-based implant codenamed OWAReaper that's specifically built for persistent access within Microsoft's webmail client.
The new wave of exploitation revolving around CVE-2026-42897 culminates with the deployment of a previously unknown JavaScript browser-based implant codenamed OWAReaper that's specifically built for persistent access within Microsoft's webmail client.
44 distinct techniques documented for this family, organized by ATT&CK tactic.
Commands are either fetched from public GitHub commit messages... The script queries GitHub's Commit Search API every 24 hours for specially crafted commit messages containing the target’s email address.
T1189 — Drive-by Compromise (Initial Access) ... L’attaque ne nécessite qu’une seule action de la victime : ouvrir l’email dans OWA.
UAT-7810 exploited CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 to compromise Ruckus devices and expand the LapDogs operational relay box network.
“TA488 delivers a specially crafted HTML email to an internet-facing Outlook Web Access (OWA) mailbox.”
T1566.001 — Phishing: Spearphishing Attachment ... Les leurres utilisent des sujets professionnels génériques.
The emails contained JavaScript loaders and Base64-encoded payload fragments hidden within URLs associated with social-media-style icons.
Proofpoint, who detected emails carrying the concealed exploit hitting inboxes. “The subject lines and lures are banal, likely so the targeted user opens and skims the message, but dismisses the message as junk without reporting it, especially given that there are no suspicious URLs or attachments present,”
It periodically searches GitHub commit messages for encrypted commands containing the victim's email address and can also receive commands through specially formatted emails stored in OWA's cache.
T1059.007 — Command and Scripting Interpreter: JavaScript ... réception et exécution de modules JavaScript chiffrés.
TA458 and Void Blizzard exploited the “Half-click” vulnerability in Zimbra, Outlook Web Access, Roundcube, and SOGo
OWAReaper also enables browser caching and places a malicious iframe into messages stored in OWA's offline IndexedDB database, allowing the payload to execute again when a poisoned message is opened from the cache.
This allows a loader piece of JavaScript to use the onload= event handler to parse the rest of the message body, assemble a Base64 fragment, and execute it as encoded JavaScript.
appel UpdateFolder via EWS pour accorder les droits Owner à l’utilisateur Default sur tous les dossiers.
T1176 — Browser Extensions (Persistence).
It then abuses Exchange's "UpdateFolder" operation to grant Owner-level permissions to the "Default" user across the victim's mail folders.
appel UpdateFolder via EWS pour accorder les droits Owner à l’utilisateur Default sur tous les dossiers.
Le payload JavaScript malveillant est dissimulé dans des fragments d’URL d’images ... encodé en Base64.
Auto-nettoyage : réécriture de l’email compromis via les API Outlook pour effacer les artefacts.
“Uses Outlook APIs to rewrite the compromised email on the Exchange server, removing embedded exploit components and minimizing forensic evidence.”
Rewrites the original email on the server to erase the exploit code
It also planted a hidden iframe in messages held in OWA's offline IndexedDB cache, which re-infected the target even after the host was re-imaged.
OWAReaper also enables browser caching and places a malicious iframe into messages stored in OWA's offline IndexedDB database, allowing the payload to execute again when a poisoned message is opened from the cache.
This allows a loader piece of JavaScript to use the onload= event handler to parse the rest of the message body, assemble a Base64 fragment, and execute it as encoded JavaScript.
It then abuses Exchange's "UpdateFolder" operation to grant Owner-level permissions to the "Default" user across the victim's mail folders.
Vol de tokens OAuth : abus de GetClientAccessToken() sur les add-ins avec permission ReadWriteMailbox.
T1539 — Steal Web Session Cookie (Credential Access).
T1552.001 — Unsecured Credentials: Credentials In Files (Credential Access).
It can collect the victim's email address, username and Outlook configuration, while also attempting to capture credentials by creating invisible DOM elements that allow the browser's autofill mechanism to populate usernames and passwords.
“Injects invisible DOM input fields and monitors browser autofill events to capture stored Outlook Web Access credentials.”
It then abuses Exchange's "UpdateFolder" operation to grant Owner-level permissions to the "Default" user across the victim's mail folders.
The goal, as with the campaign against Zimbra users, was to steal emails and account credentials.
Reconnaissance : collecte de métadonnées de boîte mail, identité, configuration Outlook.
local system data collection... were repeatedly observed.
“Monitor, collect, and exfiltrate emails, attachments, and other sensitive mailbox content.”
Reconnaissance : collecte de métadonnées de boîte mail, identité, configuration Outlook.
OWAReaper operates entirely within the OWA reading pane.
granting Exchange's low-privilege Default user Owner-level permissions on every mail folder, opening the mailbox to any authenticated account in the organization.
The data to exfiltrate is first encrypted using AES-CTR, then Base32-encoded... For the HTTPS exfiltration method, OWAReaper attempts to send encrypted data masquerading as asset requests.
For data theft, OWAReaper primarily uses HTTPS with encrypted URI paths that can be routed through image CDN services.
HTTPS primaire : données chiffrées AES-CTR routées via des CDN d’images légitimes ... vers acocdn[.]com.
DNS tunneling : fallback avec données Base32-encodées en sous-domaines.
GitHub Commit Search API : interrogé toutes les 24h, commandes AES-CTR chiffrées.
Commands arrived via GitHub commit messages, queried daily, or inbound emails polled every five minutes.
“Commands are AES-CTR encrypted” and “data is AES-CTR encrypted, Base32-encoded ... and queried against actor-controlled domains.”
commandes AES-CTR chiffrées ... données chiffrées AES-CTR.
Deux protocoles d’exfiltration : HTTPS primaire ... DNS tunneling : fallback.
Should this approach fail, the malware uses DNS label tunneling to smuggle data within standard DNS queries of an actor-controlled domain.
“HTTPS exfiltration through image CDN relays” and “File bodies are POSTed unencrypted.”
It rewrote the original email on the server to strip the exploit
31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.