TA488 OWAReaper Outlook Web Access exploit

In late July 2026, the Russia‑aligned cyber‑espionage group TA488 (also known as Laundry Bear or Void Blizzard) was observed exploiting a critical cross‑site scripting flaw (CVE‑2026‑42897) in Microsoft Outlook Web Access. The “half‑click” exploit required only opening a crafted email, allowing the group to install the OWAReaper backdoor, which persists in the browser session and retains Owner‑level permissions even after password changes or device re‑imaging. The campaign, first reported on July 22, targeted government agencies, telecoms, financial services, hospitality and aerospace firms across the United States and Europe. Microsoft had disclosed the vulnerability in May and issued a patch in June, but the exploit was active before the public fix.

A follow‑up report the next day reiterated the same exploit chain, confirming that TA488 had been abusing the flaw since May 2026. While the focus remained on the OWAReaper threat, the report also noted a separate cloud‑based data breach at biotech firm Amgen attributed to the ShinyHunters group, underscoring a broader rise in sophisticated cyber‑attacks on enterprise and healthcare systems.