Russian spies take their half-click email attack from Zimbra to Outlook
Russian-linked espionage group TA488, also known as Laundry Bear, has reportedly adapted an email-based attack previously used against Zimbra to target on-premises Microsoft Outlook Web Access. Opening a malicious email can trigger attacker-controlled code within an authenticated mail session without requiring the recipient to click a link or download a file, undermining standard phishing precautions; Exchange Online is not affected.
Proofpoint said TA488 exploited CVE-2026-42897, an Outlook Web Access cross-site scripting flaw, against government bodies and firms in sectors including telecommunications, finance, hospitality and aerospace across the US and Europe. The group deploys a mailbox-resident browser implant called OWAReaper, which can persist through password changes and device rebuilds, and may have exploited the flaw from March—around two months before Microsoft’s May patch disclosure.
In short
- TA488 weaponised Outlook Web Access emails to execute code when messages are opened.
- The attack affects on-premises Exchange, not Exchange Online.
- Mailbox-based persistence can survive password resets and rebuilt devices.
Explained simply
Russian hackers have discovered how to send emails that automatically run malicious code when opened, without requiring recipients to click anything or download files. This works by exploiting a security weakness in Microsoft Outlook Web Access, the web-based version of Outlook that companies run on their own servers. The attack is more effective than traditional phishing because it bypasses protections that rely on users clicking suspicious links.
The hacking group, known as TA488 or Laundry Bear, has been linked to Russian espionage operations. They have targeted government agencies and companies in critical sectors including telecommunications, finance, aerospace and hospitality across the United States and Europe. The group appears to have been exploiting this security weakness since at least March, several months before Microsoft released a patch in May.
What makes this particularly dangerous is the malicious software the hackers install, called OWAReaper, which can persist inside a compromised email account even after victims change their passwords or rebuild their computers. This allows the attackers to maintain long-term access to steal messages and sensitive information without being detected and removed through normal security measures.