The Exchange server flaw: What IT Teams Must Do

The Exchange server flaw is being actively exploited right now by Russian state hackers to backdoor unpatched machines and steal credentials, according to security researchers. It's a serious threat. The group behind the attacks is tracked as TA488, a unit operating on behalf of the Kremlin, and they've recently expanded their reach after previously targeting a zero-day vulnerability in a Zimbra email service. But don't mistake them for amateurs. Also identified by the tracking names Laundry Bear and Void Blizzard, this crew has shown they can pivot quickly between different targets. So we can't ignore the danger. Their methods are evolving, and the stakes for unpatched systems remain high.

TA488 is exploiting this high-profile Microsoft vulnerability, and that discovery has raised serious alarms. But the delivery method is what makes this threat truly dangerous, because attackers don't need to trick a user into clicking a malicious link or downloading an attachment, and they don't even need to rely on the usual phishing lures that we've all been trained to recognize and avoid. They use a half-click exploit instead. Simply opening an email in an Outlook Web Access account is enough to compromise the entire system. It's that easy.

How the OWAReaper malware works

The chain ends with OWAReaper, a custom-built, browser-based JavaScript implant. It's purpose-built for one thing. Persistent access inside Outlook Web Access. So the malicious code executes entirely within the reading pane of the email client, which means it can run silently in the background while the user reads their messages, and they won't see a thing.

Once active, OWAReaper performs several stealthy actions to hide its presence and harvest user information. Let us break down how this malware operates step by step:

• It uses Outlook APIs to rewrite the email directly on the Exchange server to delete the original exploit content, leaving no obvious trace of the attack.
• It disables Outlook Web Access pop-ups and turns off right-click functionality while the script runs to prevent user interference.
• It creates a unique session key for each specific target and gathers the victim's email address, username, and Outlook configuration settings.
• It inserts two invisible input elements into the Document Object Model, waiting for the browser auto-fill function to insert the user's saved credentials.
• It writes an encrypted version of itself and a decryption wrapper into the browser local storage under the PageDataPayload.OwaUserDefaultSettings key.

Persistent access on the server side

The placement in local storage is a strategic move. It abuses a legitimate key that Outlook Web Access uses during normal page rendering, so the malware hides in plain sight without triggering any alarms. Every single time an infected user opens a new Outlook Web Access tab, the standard page sync process automatically runs OWAReaper, and that sync process can't be skipped or disabled by the user. So this ensures the hackers keep their foothold. Even a password change won't boot them out.

This persistent access lives on the server side and requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user’s device will not evict the actor, Proofpoint researchers explained.

Basic credentials? That's just the start. But the backdoor doesn't stop there, and in many instances it can successfully harvest OAuth tokens, which then grant the attackers full access to the mailbox of any authenticated user on the same corporate network. It's a complete takeover.

The technical details of CVE-2026-42897

The vulnerability is tracked as CVE-2026-42897. The core problem is a cross-site-scripting vulnerability, caused by the system not adequately filtering HTML in incoming emails, which allows malicious code to run. It's a simple mistake, but it's dangerous. Because the system can't sanitize this input, malicious JavaScript execution becomes possible. And that's all it takes.

Microsoft initially issued mitigation advice for the security flaw in May and released a formal patch in July. The software giant assigned the vulnerability its maximum severity rating. Despite the patch being available, researchers believe TA488 may have exploited this flaw as a zero-day before the fix was deployed, meaning some networks might have been compromised long before the July update was applied.

The limits of standard updates

But there is a catch. Simply applying the July patch now might not be enough to clean up an already compromised environment. It remains unclear whether systems infected by OWAReaper are automatically disinfected once the Microsoft patch or the Exchange Emergency Mitigation service is installed.

Once the backdoor has already established a foothold, the malicious code remains embedded deep within your Exchange server, and simply restarting services or running a standard antivirus scan won't dislodge it. So IT departments can't rely on automated tools to save them here. They must take manual, deliberate action. It's the only way to ensure their environments are completely clean. But that process demands patience and precision, because a single overlooked registry key or a forgotten scheduled task can leave the door wide open for a second intrusion. That's why a thorough, step-by-step audit of every compromised system is absolutely necessary before anyone declares victory.

Steps IT teams must take now

Wondering if this matters to your organization? It does. But anyone running an unpatched Exchange server with active Outlook Web Access is at risk, and that risk isn't theoretical, it's a live door left open for attackers who don't need much else to walk straight through it. If you suspect your systems have been exposed, you must go beyond standard patching protocols, because a simple update won't undo the damage that's already been done. Act now.

Security researchers advise affected organizations to perform a thorough audit. Here is the checklist your technical team needs to execute immediately:

• Revoke and audit all Exchange Web Services tokens to check for unauthorized add-ins.
• Remove folder permissions granted to default users.
• Clear the Outlook Web Access indexDB and delete the PageDataPayload.owaUserDefaultSettings local storage key.
• Configure network defenses to block or alert on outbound connections to known command-and-control servers.

Command and control domains to block

Monitoring outbound network traffic is a critical step in identifying a live compromise. It's the moment you catch them. So your security team should immediately configure firewalls and intrusion detection systems to watch for traffic directed at the infrastructure used by the attackers, because that's where the digital breadcrumbs lead, and you can't afford to blink. Do it now.

Specifically, look for outbound connections to the following domains: asecdns[.]com, acocdn[.]com, dnsrecursive[.]eu, and tdndns[.]com. Any active connection to these addresses is a strong indicator of compromise and requires immediate incident response procedures.