TA488 OWAReaper: A "Half-Click" Attack that Adds Persistence Inside OWA Just by Opening an...
TA488 OWAReaper: A "Half-Click" Attack that Adds Persistence Inside OWA Just by Opening an Email
1. Basic Information
Article Name: Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit
Publisher: Proofpoint Threat Insight
Publication Date: 2026-07-29
Opening a booby-trapped message unleashes a browser implant that can survive password changes and device rebuilds
Russian hackers exploit CVE-2026-42897 in OWA to deploy OWAReaper, a browser implant that persists through credential rotation…
Il gruppo criminale filorusso TA488 sfrutta la CVE-2026-42897, falla XSS in Outlook Web Access, con un exploit half-click: basta…
The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access…
A security vulnerability in OWA allows JavaScript code execution by displaying emails. Russian actors are exploiting this.
Eine Sicherheitslücke in OWA ermöglicht durch Anzeigen von Mails das Ausführen von JavaScript-Code. Russische Akteure nutzen das…
Russian spies take their half-click email attack from Zimbra to Outlook
Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation
Falla in Outlook: apri un’e-mail e ti infettano, non servono più link o allegati
Russian hackers exploit Exchange OWA zero-day for long-term mailbox access
Russian actors attack via Outlook Web Access vulnerability
Russische Akteure greifen über Outlook-Web-Access-Lücke an
A security researcher built a self-spreading worm that hides inside Word docs and hijacks Microsoft Copilot
Max-severity Exchange server flaw under active exploitation by Kremlin hackers
Hidden prompt turns Microsoft Copilot into an AI worm
Microsoft Copilot’s ‘Word worm’ still works 144 days after disclosure
