Home / Technology / Russian Hackers Exploit Outlook for Data Theft
Russian Hackers Exploit Outlook for Data Theft
31 Jul
Summary
- Russian state hackers exploit critical Outlook vulnerability.
- New 'OWAReaper' malware steals credentials via email.
- Microsoft patched the vulnerability in July.
Russian state hackers, tracked as TA488, are leveraging a critical vulnerability in Microsoft's Outlook Exchange Server. This exploit targets unpatched systems, enabling the theft of sensitive data and credentials.
The group, also known as Laundry Bear and Void Blizzard, is using a sophisticated browser-based implant named OWAReaper. This malware operates entirely within the Outlook Web Access (OWA) reading pane, removing exploit traces while stealing user data and saved credentials through browser autofill.
Microsoft issued mitigation advice in May and a patch in July for the cross-site-scripting vulnerability (CVE-2026-42897). However, TA488 may have exploited it as a zero-day, demonstrating improved tradecraft and capability.
OWAReaper's persistence is significant, as it resides on the server side and is not removed by credential rotation or device re-imaging. Proofpoint advises users to audit Exchange Web Services tokens and take specific steps to remove the backdoor.
