Laundry Bear exploits Exchange OWA zero-day to deploy persistent OWAReaper backdoor via email

Summary

The threat actor known as Laundry Bear, also tracked as Void Blizzard, has launched a campaign targeting government entities in the U.S. and Europe, alongside organizations in the telecommunications, financial, hospitality, and aerospace sectors. The attack exploits a cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) to deliver OWAReaper, a sophisticated browser-based implant designed for long-term mailbox access.

The campaign utilizes "half-click" tactics, where the mere act of viewing an email in the webmail reading pane triggers the execution of malicious JavaScript. This activity follows previous targeting of Zimbra email servers with the ZimReaper malware, representing a significant escalation in the group's technical capabilities and tradecraft.

Technical details

The exploit targets CVE-2026-42897, a flaw where the Exchange server fails to adequately sanitize HTML within message bodies. When a user opens a specially crafted email, the server mishandles the HTML, allowing a JavaScript loader to execute. This loader parses fragments of the message body-often hidden behind social media icon URLs after a '#' character-to assemble and run the full payload.

Once active in the OWA reading pane, OWAReancer performs several immediate actions:

• It uses Outlook APIs to rewrite the original email on the Exchange server, stripping out the exploit content to hide its tracks.
• It disables OWA pop-ups and right-click functionality while running.
• It creates invisible elements in the Document Object Model (DOM) to capture usernames and passwords when a user's browser attempts an autofill.

The malware maintains command-and-control (C2) through two channels: querying GitHub commit messages via the Commit Search API every 24 hours, and parsing inbound emails for specific Base64-encoded strings stored in the browser's IndexedDB cache.

Persistence mechanisms

OWAReaper is designed to survive standard remediation efforts like credential rotation or full device re-imaging. It employs three distinct layers of persistence:

1. OAuth Token Theft: The malware scans for installed Outlook add-ins with ReadWriteMailbox permissions. It uses these to call GetClientAccessToken and then executes UpdateFolder to grant itself "Owner-level" permissions for the "Default" user alias on every mail folder in the tenant. This provides access to the mailbox from any authenticated account within the organization.
2. LocalStorage Injection: The implant writes an encrypted version of itself into the browser's localStorage under the PageDataPayload.OwaUserDefaultSettings key. This ensures the malware executes every time a user opens an OWA tab.
3. IndexedDB Cache Poisoning: The malware injects a hidden iframe into messages stored in the offline IndexedDB cache. This iframe re-infects the target whenever a poisoned email is opened from the local cache.

Why this matters for defenders

Traditional endpoint security and identity management may fail to stop this threat because the persistence is established on the server side via Exchange permissions and within the browser's local storage. Because the "Default" user alias receives Owner-level permissions, an attacker can maintain access even if the specific compromised account is secured or deleted.

The use of "banal" email subjects-such as updates on gas markets, semiconductor supply chains, or public health surveillance-is intended to bypass suspicion and encourage users to skim the message without reporting it as junk.

Defender guidance

To mitigate this threat, security teams should focus on server-side configuration and browser-level artifacts:

• Patch Exchange Servers: Ensure all Microsoft Exchange environments are updated with the out-of-band patch released by Microsoft for CVE-2026-42897.
• Audit Mailbox Permissions: Inspect Exchange tenants for unauthorized permission changes, specifically looking for "Owner-level" access granted to the "Default" user alias on mail folders.
• Review Outlook Add-ins: Audit installed OWA and thick-client add-ins that possess ReadWriteMailbox permissions, as these are leveraged to steal OAuth tokens.
• Monitor Browser Artifacts: Investigate browser localStorage for suspicious entries in the PageDataPayload.OwaUserDefaultSettings key and monitor IndexedDB for unexpected iframe injections.
• Analyze C2 Patterns: Monitor for unusual outbound traffic to GitHub's Commit Search API or connections to specific image CDN domains used for data exfiltration via HTTPS.