Laundry Bear uses CVE-2026-42897 to preserve access to Microsoft OWA mailboxes
Proofpoint reported on July 30, 2026, that Laundry Bear has been exploiting the patched CVE-2026-42897 in Microsoft Outlook Web Access since July 22. The cross-site scripting flaw carries a CVSS score of 8.1 and has affected U.S. and European government entities alongside telecommunications, financial, hospitality, and aerospace organizations.
An email only needs to be opened
The campaign uses compromised accounts to distribute vague messages about supply chains, research, tourism, or gas markets. They contain neither links nor attachments and require no deliberate interaction: viewing one in a vulnerable OWA reading pane triggers the exploit.
Embedded JavaScript uses an onload event to reconstruct and execute a Base64 payload concealed in social media icons. The broad mailing volume helps the operation resemble ordinary spam, while the neutral subject matter makes recipients more likely to open and skim the message.
OWAReaper establishes layered persistence
The exploit installs OWAReaper, a browser-based JavaScript implant derived from ZimReaper. It rewrites the malicious email on the Exchange server to remove exploit content, gathers account and Outlook settings, and creates invisible fields designed to capture credentials saved by browser autofill.
OWAReaper stores an encrypted copy of itself in localStorage, allowing execution whenever OWA is opened. It also places a hidden iframe in the offline IndexedDB message cache. If a suitable Outlook add-in has ReadWriteMailbox permission, the implant can steal OAuth tokens and grant the Default user Owner-level access to every mail folder.
This persistent access lives on the server-side and requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user's device will not evict the actor.
Commands arrive through GitHub commit searches every 24 hours or specially formatted inbound emails. Exfiltration uses AES-CTR-encrypted HTTPS paths, with DNS tunneling as a fallback. For businesses, patching OWA is only the first step: teams should audit Exchange folder permissions, privileged add-ins, OAuth tokens, active sessions, browser storage, and cached messages before treating an affected mailbox as clean.
OWAReaper in Microsoft OWA: what can persist after compromise
OWA Reaper, also written as OWAReaper, is a browser-based JavaScript implant associated with exploitation of CVE-2026-42897. Its persistence can extend beyond the affected device, so incident response should examine the mailbox, Exchange permissions, browser storage, cached messages, tokens, and active sessions.
How OWAReaper is triggered
The reported campaign sends compromised-account emails without links or attachments. Opening a message in a vulnerable OWA reading pane can execute JavaScript hidden in social media icons, after which the implant removes the exploit content from the email and collects account and Outlook settings.
- The message only needs to be viewed in a vulnerable OWA reading pane.
- Embedded JavaScript reconstructs and runs a Base64 payload.
- Neutral subjects and broad distribution can make the email resemble ordinary spam.
Why password resets and device re-imaging may not remove access
OWAReaper can store an encrypted copy of itself in browser localStorage and place a hidden iframe in the offline IndexedDB message cache. If a suitable Outlook add-in has ReadWriteMailbox permission, the implant can also steal OAuth tokens and alter server-side folder permissions. These mechanisms explain why replacing credentials or re-imaging one device may not fully evict the actor.
- Browser storage can run the implant again when OWA is opened.
- Cached messages can retain a hidden persistence mechanism.
- Server-side folder permissions require deliberate review and removal.
Post-compromise checks for Microsoft OWA
Applying the available patch addresses the vulnerability, but the reported persistence paths require a wider investigation before a mailbox is treated as clean.
- Audit Exchange folder permissions, including unexpected Owner-level access.
- Review add-ins that have ReadWriteMailbox permission.
- Inspect OAuth tokens and active sessions for signs of misuse.
- Check localStorage, IndexedDB, and cached OWA messages.
- Remove identified persistence from Exchange as well as affected devices.
Frequently asked questions
What is OWA Reaper or OWAReaper?
OWAReaper is a browser-based JavaScript implant derived from ZimReaper. In the campaign described above, it is delivered through CVE-2026-42897 and is designed to preserve access to Microsoft OWA mailboxes.
Does an OWAReaper email need a link or attachment?
No. The reported emails contain neither links nor attachments. Viewing one in a vulnerable OWA reading pane can trigger the embedded JavaScript.
Is patching Microsoft OWA enough after suspected exploitation?
Patching is necessary, but it may not remove persistence already established in browser storage, cached messages, OAuth tokens, add-ins, active sessions, or Exchange folder permissions.
Will changing the password remove OWAReaper?
Not necessarily. The described persistence can exist in browser storage and on the Exchange server, so credential rotation alone may leave other access paths intact.