Outlook Zero‑Day Attack: Opening an Email Triggers Execution via OWA HTML Mis‑handling

Attack Overview

After a two‑year lull, the TA488 group (also known as Void Blizzard or Laundry Bear) resumed activity on July 22, 2026—one day before Microsoft released an emergency patch for CVE‑2026‑42897. The campaign targets U.S. and European government agencies and sectors such as telecom, finance, hospitality, and aviation. Infrastructure was set up in March 2026, the patch was published in May, and the group likely leveraged a two‑month zero‑day window.

Vulnerability Mechanics (CVE‑2026‑42897)

The flaw is a stored cross‑site scripting (XSS) in Outlook Web Access (OWA). The server insufficiently sanitises HTML in email bodies, allowing an attacker to embed malicious HTML/JavaScript. When the email is rendered in the OWA reading pane, the server mis‑processes the HTML and executes the injected script.

Payload Hiding Technique

TA488 employs a three‑layer payload storage scheme:

Initial Trigger : A onload= handler is hidden inside the HTML of a social‑media icon in the email body. When the email loads, the handler runs.

Payload Storage : The malicious code is split into several Base64 fragments placed at different locations in the email. The # character stops normal image Base64 parsing, so the fragments remain invisible to standard rendering.

Dynamic Decoding : The initial trigger reads the fragments, concatenates them, decodes the Base64 string, and executes the resulting JavaScript.

This separation makes the malicious content less obvious than earlier attacks against Zimbra.

Social‑Engineering Bait

The emails use bland subject lines that mimic industry newsletters, such as:

"Semiconductor Supply Chain Indicators: Capacity, Packaging, and Pricing"

"Global Gas Markets: Flows, Capacity, and Price Differentials"

"Hydrological indicators: Reservoir levels and snowpack"

There are no suspicious links or attachments, encouraging recipients to dismiss the message as harmless—a classic “half‑click” attack.

OWAReaper Backdoor Technical Analysis

Core Architecture

OWAReaper runs entirely within the OWA browser context, leaving no files or processes on the host. It is an evolution of the ZimReaper backdoor, with improved operational security: it no longer leaks large volumes of email and focuses on targeted credential theft.

Initialization Process

Self‑destruct : Calls the Outlook API to rewrite the email on the Exchange server and immediately deletes the malicious content from the message body.

Lockdown : Disables OWA pop‑up windows and the right‑click menu to prevent the victim from inspecting the page source.

Session Establishment : Generates a unique session key per target and begins harvesting the victim’s mailbox address, username, and Outlook settings.

Credential Theft : Creates two invisible input elements positioned at -9999px/-9998px in the DOM, waits for the browser to auto‑fill them, and captures the saved OWA credentials.

Three‑Layer Persistence

OWAReaper implements persistence at three levels, each addressing a different recovery scenario:

Layer 1 – localStorage : Stores an encrypted version of itself and a decryption wrapper under the legitimate key PageDataPayload.OwaUserDefaultSettings. The code executes each time the user opens an OWA tab because the normal sync process reads this key.

Layer 2 – Exchange Folder Owner Permission : Checks for an Outlook add‑in with ReadWriteMailbox rights (e.g., GetClientAccessToken) and, if present, calls UpdateFolder to grant the low‑privilege “Default” user Owner rights on every mail folder. This server‑side backdoor survives credential rotation and system re‑installs.

Layer 3 – IndexedDB iframe : Inserts a hidden iframe into the offline IndexedDB cache of OWA messages. When the cached, infected email is opened later, the iframe re‑executes the payload, persisting even after a full OS reinstall as long as the cached mail remains.

Command‑and‑Control (C2)

Two complementary channels are used:

Channel 1 – GitHub Commit Search : Every 24 hours the backdoor queries the GitHub Commit Search API for commits containing the target’s email address. The response is encrypted with a hard‑coded AES‑CTR key and a per‑session key. After decryption, the first four bytes indicate the command type. Supported commands are: code: Replace the entire OWAReaper toolkit. domn: Rotate the C2 server address. cmnd: Execute arbitrary JavaScript via eval().

Channel 2 – Inbound Email Commands : Every five minutes OWAReaper scans the IndexedDB for recent inbound emails. It looks for a payload formatted as {target email}{space}{Base64}. The handling mirrors the GitHub channel and supports the same three commands. The attacker likely hides these command emails using the same benign subject lines.

Data Exfiltration

Two exfiltration paths are implemented:

Primary – HTTPS CDN Proxy : Encrypted data is disguised as a static resource request, e.g., /assets/v1_<base64_aes_data>, and fetched through legitimate CDN services such as Weserv.nl, WordPress CDN (i3.wp.com), and Slack image CDN (slack‑imgs.com). The CDN retrieves the file from the attacker‑controlled domain acocdn.com, relaying the data to the adversary. If all CDN proxies fail, the backdoor falls back to direct C2 communication.

Fallback – DNS Tunnel : The payload is AES‑CTR encrypted, Base32‑encoded using a limited alphabet (0‑9, a‑v), split into 2‑4 substrings, and each substring is used as a sub‑domain in a DNS A query to the attacker’s domain. The attacker reconstructs the data from the DNS traffic.

C2 Infrastructure

Observed domains include: asecdns.com – OWAReaper C2 (first seen March 2025) acocdn.com – OWAReaper C2/relay (first seen March 2025) dnsrecursive.eu – OWAReaper C2 (first seen April 2025) tdndns.com – OWAReaper C2 (first seen April 2026)

Detection and Remediation Recommendations

Revoke and audit Exchange Web Services (EWS) tokens for any compromised add‑ins.

Audit and remove all Default user Owner permissions on Exchange folders.

Clear OWA’s IndexedDB ( owa_offline_db) and delete the localStorage key PageDataPayload.OwaUserDefaultSettings.

Block or alert outbound connections to the identified C2 domains.

Apply Microsoft’s emergency patch for CVE‑2026‑42897 (see the Microsoft Exchange Team Blog).

Deploy Snort/Suricata rules released by Proofpoint, e.g.,

ET EXPLOIT Microsoft Exchange OWA XSS (CVE‑2026‑42897)

ET MALWARE OWAReaper C2 Beacon

ET MALWARE OWAReaper C2 File Exfiltration

ET MALWARE OWAReaper DNS Tunnel Exfiltration