Digital Warfare Podcast Daily Brief #139 July 30, 2026

The Digital Warfare Podcast · Jul 30, 2026 · 4m · transcript

Summary

A Russian state-sponsored threat actor is exploiting CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Exchange Outlook Web Access, to deploy a browser-based implant called OWAReaper.

The attack can be triggered when a user opens a specially crafted email in OWA. The implant steals account information, abuses OAuth-enabled add-ins, changes server-side mailbox permissions, and establishes persistence through both OWA settings and cached browser messages.

Because some of the persistence exists on the Exchange server, changing passwords or rebuilding a workstation may not…