OWAReaper keeps Exchange mailbox access after credential rotation and re-imaging

Proofpoint researchers have detailed OWAReaper, a browser implant that the Russian-aligned actor TA488 (also tracked as Laundry Bear and Void Blizzard) is deploying through CVE-2026-42897 in Outlook Web Access. The implant enumerates installed Outlook add-ins holding ReadWriteMailbox permission, steals their OAuth tokens, and then grants the Default user Owner-level permission on every mail folder, which hands complete mailbox access to any authenticated account in the tenant. A second persistence path hides an iframe in messages stored in the OWA offline IndexedDB cache. Targets include United States and European government bodies plus telecommunications, financial, hospitality, and aerospace organisations.

Why it matters

The interesting part is not the zero-day, it is where the persistence lives. Patching, re-imaging the laptop, and rotating the password all leave the mailbox permission grant untouched, because the attacker's access is now an authorisation object on Exchange rather than a credential or a file on disk.

That is the generalised lesson: an access token stolen from a consented add-in, and a folder permission written afterwards, both outlive the credential lifecycle that most incident response runbooks stop at. If your containment checklist ends at reset the password and reimage the device, it does not contain this.

Concretely, audit Default and Anonymous permissions across mail folders, enumerate add-ins holding ReadWriteMailbox, and revoke refresh tokens rather than only resetting passwords. Our IAM incident response playbook and the token theft entry cover the pattern.

Source: The Hacker News