Meet OWAReaper: The Grim Reaper's Evil Twin That Survives Your Incident Response
CVE-2026-42897 was patched in June. A Russia-aligned crew started weaponizing it in July — and the JavaScript it drops doesn't leave when you rotate credentials or reimage the box.
Every horror franchise eventually runs out of new monsters and reboots the old one with a smaller budget and a meaner attitude. Sequels rarely improve on the original — they're usually cheaper, faster, and somehow harder to kill. We regret to inform you that enterprise webmail malware now works the same way.
Last year, a payload called ZimReaper turned a CSS trick in Zimbra's Classic Web Client into a mailbox-draining zero-day for a Russia-aligned crew (we covered it — do keep up: CVE-2025-66376). This year, the sequel arrived. It's called OWAReaper, it targets Microsoft Exchange instead of Zimbra, and per the researchers who found it, it shares "significant code and behavioral overlaps" with its predecessor. Different building, same landlord.
Right. Bit over. Let's talk about what happens when a government employee opens an email in Outlook Web Access, because in July 2026 the answer turned out to be: everything.
Scores as of 2026-08-05live record →
The Half-Click You Didn't Click
CVE-2026-42897 is textbook CWE-79 — improper neutralization of input during web page generation, or, in Microsoft's press-release-friendly phrasing, a "spoofing" bug. That word choice is doing a lot of quiet work: the CVSS vector reads C:H/I:H — full confidentiality and integrity impact — which is not what we'd normally associate with a polite spoof. OWA fails to sanitize HTML inside the message body, so a crafted email carries live JavaScript straight into the reading pane.
OWAReaper: ZimReaper's Cousin Gets a Promotion
OWAReaper is a newly identified JavaScript implant that Proofpoint calls an evolution of the ZimReaper payload from the 2025 Zimbra campaign, citing significant code and behavioral overlap between the two. It runs entirely client-side, inside the OWA reading pane, and its first move is to clean up after itself: it uses Outlook's own APIs to rewrite the message on the Exchange server and strip the exploit content out — so the malicious email a SOC analyst goes looking for later doesn't exist anymore. While it's running, it disables OWA pop-ups and right-click, then drops two invisible input elements into the DOM to harvest whatever the browser autofills.
| Label | Value |
|---|---|
| CVE-2025-66376 (Zimbra / ZimReaper) | 21.97 |
| CVE-2026-42897 (Exchange / OWAReaper) | 70.31 |
The reading-pane-to-exfil chain
- Crafted email lands in inbox
- Victim opens email in OWA reading pane
- XSS fires — JS executes client-side
- Self-cleans: rewrites email server-side to erase the exploit
- Harvests credentials via hidden DOM fields
- Seeds 3-layer persistence (localStorage / OAuth add-in / IndexedDB)
- C2 check-in (GitHub commit search / inbound email)
- Exfil via CDN-proxied HTTPS or DNS tunnel
- localStorage sync abuse — OWAReaper writes an encrypted copy of itself into localStorage under the key
PageDataPayload.OwaUserDefaultSettings, exploiting the fact that OWA itself evaluatesOwaFrontendSyncStateas part of its own sync-restore flow. The browser reinfects itself on its next load, using OWA's own code against it. - Mailbox ACL abuse — it uses Outlook add-ins with ReadWriteMailbox permissions to steal OAuth tokens via
GetClientAccessToken, then grants Owner-level permissions to the "Default" user on every mail folder. The backdoor isn't a file on disk; it's a permission grant sitting in your mailbox configuration. - IndexedDB reinfection — a hidden iframe gets embedded into messages cached in OWA's offline IndexedDB store (
owa_offline_db). Opening a previously received, already-"cleaned" email re-triggers the payload — which is how it survives a full endpoint reimage.
Command and Control, But Make It GitHub
OWAReaper checks in over two channels: polling GitHub's public Commit Search API every 24 hours for specially crafted commit messages, and parsing inbound attacker emails while checking its own IndexedDB cache every five minutes for new instructions. Three command types cover the operational lifecycle — code replaces the entire toolkit, domn rotates C2 infrastructure, and cmnd runs a one-time eval(). Exfiltration runs over HTTPS (AES-CTR encrypted, proxied through legitimate CDNs — Weserv.nl, i3.wp.com, slack-imgs.com — to blend in with normal traffic) or, if that's blocked, over DNS (AES-CTR then Base32-encoded into subdomain labels).
| Indicator | Type | Role in the campaign |
|---|---|---|
| asecdns[.]com | Domain | Earliest infrastructure (~March 2026); predates the June fix |
| acocdn[.]com | Domain | HTTPS exfil relay, proxied via legitimate CDNs |
| dnsrecursive[.]eu | Domain | DNS-tunnel fallback channel |
| tdndns[.]com | Domain | DNS-tunnel fallback channel |
| ews_extensions_debug.json | Exfil filename | EWS/add-in debug data |
| msanalytics.json | Exfil filename | Telemetry/analytics dump |
| cmnd_[HASH]_[FILENAME] | Exfil filename pattern | Command-result exfiltration |
| poison_wizard_error_dom.html | Exfil filename | Captured DOM/error state |
Patched In June, Weaponized In July — Read The Dates
CVE-2026-42897, start to campaign
- Earliest attacker infrastructure registeredasecdns[.]com and acocdn[.]com created roughly two months before Microsoft's permanent fix — the basis for the "feasible zero-day" assessment.
- Microsoft discloses CVE-2026-42897CVSS 8.1 advisory published with a temporary mitigation; the permanent fix is still weeks out.
- CISA adds it to the KEV catalogDue date May 29, 2026 — federal agencies given two weeks against a bug that wasn't fully fixed yet.
- Permanent fix shipsOut-of-band patch closes the reading-pane XSS path on Microsoft's June Patch Tuesday.
- TA488 campaign goes liveAfter roughly five months of observed inactivity (Feb–Jul), the actor resumes with OWAReaper against government and private-sector targets.
- Joint Proofpoint–NSA advisory publishedPublic disclosure of TA488 / Void Blizzard / Laundry Bear tradecraft, one day after the campaign resurfaced.
“We patched it” vs. “We're actually safe”
- The June out-of-band build rejects the crafted-HTML exploit path
- New exploit emails against the reading pane stop firing
- Vendor and scanner status reads “fixed”
- Implants dropped before the patch landed keep running — persistence lives in localStorage / IndexedDB / mailbox ACLs, not the exploited code path
- Credential rotation alone does not evict it
- A full device reimage does not evict it either — the payload re-seeds itself server-side
- OAuth tokens minted by the poisoned add-in stay valid until someone revokes them by hand
What Blue Team Should Actually Do
Proofpoint published five Emerging Threats rules (SIDs 2071330–2071335) covering this campaign specifically. We haven't reproduced the rule bodies here — they're vendor content, not ours to paraphrase into something that might drift from the original and get someone's Suricata deployment yelling about nothing. Pull them from the source before you deploy anything against production traffic.
- Confirm you're actually on the June 9, 2026 out-of-band build or later — "we patched Exchange this year" is not the same claim.
- Revoke and audit EWS OAuth tokens for any Outlook add-ins with ReadWriteMailbox scope.
- Audit and remove folder-permission grants to the "Default" user across mailboxes — Owner-level access on "Default" is not a normal helpdesk configuration.
- Clear OWA's offline IndexedDB (
owa_offline_db) and thePageDataPayload.OwaUserDefaultSettingslocalStorage key on affected endpoints. - Block and alert on the known C2 domains, and flag any internal host polling GitHub's Commit Search API on a schedule — that's not a normal corporate access pattern.
- Don't declare victory after rotating credentials or reimaging a device alone — the persistence lives on the server side.
So: patch it if you somehow still haven't (the fix is over five months old at this point, there's no excuse left), then go find out whether anyone got in before you did — because the interesting part of this story was never the patch.
CVE data current as of 2026-08-05live record →