Latest / The Digital Warfare Podcast / Digital Warfare Podcast Daily Brief #139 July 30, 2026
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today, we are covering an advanced cyber espionage campaign targeting Microsoft Outlook Web Access. The campaign exploits CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Exchange, to deploy a sophisticated browser-based implant known as OWA Reaper. The bigger lesson is not simply that opening a malicious email can compromise an account, it is that attackers may remain inside the mailbox even after the victim changes their password or completely rebuilds their computer. Here's what happened: a Russian state-sponsored threat actor tracked as TA-488, Void Blizzard, and Laundry Bear began a new exploitation campaign on July 22nd. The group targeted government organizations in the United States and Europe, along with companies operating in telecommunications, finance, hospitality. And aerospace. The attack begins with a specially crafted email sent to a user of Outlook Web Access. There is no malicious attachment. There may be no suspicious link. The victim only needs to open the message in the OWA reading pane. CVE-2026-42897 exists because Exchange does not adequately sanitize HTML within the message body. This allows attacker-controlled JavaScript to execute inside the user's browser session. The campaign's JavaScript payload is concealed within elements such as social media icons embedded in the message. When the email is opened, the malicious code is reconstructed and executed, installing OaReap within the browser context. OAREPA does not operate like conventional endpoint malware. It runs inside Outlook Web Access and may leave no traditional executable file on the host. The implant collects the victim's email address, username, Outlook configuration and potentially credentials automatically entered by the browser. It then stores an encrypted copy of itself within legitimate OWA settings. This allows the implant to execute again whenever the user opens a new OWA browser tab. The malware can also inspect installed Outlook add-ins with read-write mailbox permissions and abuse them to obtain OAuth tokens. It then modifies exchange folder permissions. Granting the built-in default identity owner level access across the victim's mailbox folders. This is particularly serious because those permissions are stored on the exchange server. Changing the victim's password does not remove them. Re-imaging the workstation does not remove them. If the attackers control another authenticated account in the organization, they may still be able to access the targeted mailbox. OAR Reaper also establishes a second persistence mechanism using Outlook's offline indexed DB message cache. A malicious hidden frame is inserted into cached messages, allowing the target to be reinfected when a poisoned message is opened. For command and control, the implant can retrieve encrypted instructions from GitHub commit messages or process commands delivered through specially formatted emails. For data theft, it supports HTTPS communication routed through legitimate image content services, direct communication with attacker infrastructure, and DNS tunneling as a fallback. This combination gives the operators multiple options for maintaining control and removing information from a monitored environment. Microsoft originally disclosed CVE-2026-42897 in May after determining that it had been exploited as a zero-day. The vulnerability affected supported on-premises Exchange server environments using Outlook Web Access. Microsoft provided emergency mitigations through the Exchange Emergency Mitigation Service and the Exchange On-Premises Mitigation Tool. Organizations should confirm that the required Microsoft protection has been applied and investigate for signs of prior exploitation. Security teams should audit exchange web services tokens, review Outlook add-ins with read-write mailbox permissions, and identify any suspicious folder permissions assigned to the default identity. They should also clear affected OWA local storage and indexed DB data, review outbound HTTPS and DNS traffic, examine suspicious emails. And investigate unexpected mailbox access from other organizational accounts. Credentials should be rotated where exposure is suspected, but password resets must not be treated as sufficient remediation. The exchange server, mailbox permissions, OAuth tokens, browser storage, cached messages, and related accounts must all be included in the investigation. The strategic lesson is clear. Modern email compromise is no longer limited to stolen passwords and malicious attachments. Attackers are targeting the application layer. abusing trusted browser functionality, and creating persistence outside the endpoint. Defending the mailbox now requires visibility across identity, exchange configuration, browser storage, OAuth permissions, and network behavior. This has been your Digital Warfare Daily Brief. Stay secure, we'll see you tomorrow.