OWAReaper Backdoor Survives Full Device Wipes — Here's What Russian Hackers Built Into Exchange

Security researchers at Proofpoint have uncovered an active cyberattack campaign in which Russian state-sponsored hackers are weaponizing a critical flaw in Microsoft Exchange Server to plant a never-before-seen JavaScript implant on victim systems. The threat actor, tracked as TA488 and also known as Laundry Bear or Void Blizzard, operates on behalf of the Kremlin and has been ramping up its offensive capabilities in recent months. This latest campaign represents a significant escalation in both sophistication and persistence compared to previous operations attributed to the group.

The vulnerability at the center of these attacks is CVE-2026-42897, a cross-site scripting flaw in Exchange Server that Microsoft flagged with a maximum severity rating. The flaw stems from the server's failure to properly filter HTML embedded in incoming emails, allowing malicious JavaScript to execute the moment a recipient opens a message in Outlook Web Access — without any additional clicks or interaction. Microsoft issued mitigation guidance in May and released a formal patch in July, but Proofpoint believes TA488 may have been exploiting it as a zero-day well before those fixes arrived.

The malware installed through this exploit, which Proofpoint has named OWAReaper, is described by the company as the most sophisticated backdoor ever delivered via a so-called half-click exploit. OWAReaper operates entirely within the OWA reading pane, immediately using Outlook's own APIs to erase the original exploit content from the email on the Exchange server — effectively cleaning up its tracks in real time. It simultaneously disables OWA pop-ups and right-click functionality while silently harvesting the target's email address, username, Outlook settings, and browser-autofilled credentials.

What makes OWAReaper particularly alarming is how it achieves persistence. The implant writes an encrypted version of itself into the browser's localStorage under a legitimate key used by OWA during its own page rendering and sync restore flow. This means every time the compromised user opens an OWA tab, the browser's normal sync process automatically re-executes OWAReaper without any further attacker involvement. In more advanced cases, the backdoor can also steal OAuth tokens, granting full mailbox access to any authenticated user on the same network.

Proofpoint has emphasized that this persistence lives on the server side, not the device, which is what makes remediation so difficult. Rotating user credentials or completely wiping and reimaging the victim's machine will not remove the implant. Affected organizations are being advised to revoke Exchange Web Services tokens, audit for unauthorized add-ins, clear specific localStorage keys, and block outbound connections to a set of known command-and-control domains including asecdns[.]com and acocdn[.]com. It remains unclear whether installing Microsoft's July patch or the Exchange Emergency Mitigation service is sufficient to disinfect already-compromised machines.