Russia-aligned threat actor TA488 is back with a sharper playbook: exploiting Outlook Web Access (OWA) with a “half-click” email attack that can execute when a user simply opens a message in webmail. Proofpoint reports the campaign abused CVE-2026-42897 and delivered a previously unknown browser-based implant it calls OWAReaper.

The important detail is not just the exploit. It is where the attacker chose to live. OWAReaper operates inside the OWA browser context, uses webmail storage and Exchange permissions for persistence, and can survive fixes that many organizations would normally treat as complete remediation, including password resets and endpoint reimaging.

What Proofpoint reported

According to Proofpoint Threat Research, TA488 began the observed campaign on July 22, 2026, targeting U.S. and European government entities along with telecommunications, financial, hospitality, and aerospace organizations. The emails used bland business-like subject matter rather than obvious malicious links or attachments, making them easy for a user to open, skim, and ignore.

That low-friction user behavior is exactly the point. In this style of attack, there may be no attachment to detonate and no link to click. Opening the message in vulnerable OWA is enough to trigger JavaScript execution through mishandled HTML sanitization.

Why this matters for SMBs and government contractors

Small businesses and emerging government contractors often treat email security as a filtering problem: block malicious attachments, scan URLs, enforce MFA, and move on. Those controls still matter, but this campaign shows why Exchange and browser-based persistence deserve more attention.

If an attacker can turn the webmail session itself into the execution environment, traditional endpoint-centric assumptions get weaker. A clean laptop does not automatically mean a clean mailbox. A rotated password does not automatically remove malicious Exchange permissions. A quiet inbox does not mean the account is safe.

Defensive takeaways

  • Patch Exchange and OWA quickly. Treat exposed webmail vulnerabilities as internet-facing critical risks, not routine application updates.
  • Audit mailbox permissions. Look for unusual grants, especially broad access assigned to default or low-privilege principals across folders.
  • Review Outlook add-ins. Inventory add-ins with powerful mailbox permissions and remove anything unnecessary.
  • Hunt beyond the endpoint. Include OWA localStorage, IndexedDB artifacts, Exchange Web Services activity, and mailbox permission changes in investigations.
  • Watch DNS and web egress. Proofpoint described both HTTPS and DNS-based exfiltration patterns, so DNS visibility should be part of the detection plan.
  • Train users to report boring suspicious mail. A message does not need a link or attachment to be malicious if the rendering surface is vulnerable.

Bulwark Black assessment

This is the kind of campaign that punishes checklist security. MFA, endpoint reimaging, and password resets are valuable, but they are not enough when persistence lands in application state and server-side permissions. For organizations supporting federal customers, defense primes, or regulated industries, mailbox integrity should be treated as part of the core security boundary.

The practical move is to build an Exchange-focused incident checklist before an incident happens: what permissions to audit, what tokens to revoke, what browser artifacts to clear, what logs to preserve, and who is allowed to make tenant-wide changes. When webmail becomes the beachhead, response speed depends on already knowing where persistence can hide.

Source: Proofpoint — Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit.