TA488 Exploits Outlook Web Access CVE-2026-42897 in New Campaign

Csoonline

TA488 Exploits Outlook Web Access CVE-2026-42897 in New Campaign

First seen 30 Jul 2026, 08:49 UTC • •72.0

Article Content

1 / 4

Browse articles

ThreatCluster •July 30, 2026 at 22:28 UTC

•TA488 exploits CVE-2026-42897, a cross-site scripting flaw in OWA.
•The campaign deploys OWAReaper, a persistent JavaScript backdoor.
•Targeted organizations include government bodies, indicating a serious threat.

TA488 has launched a campaign exploiting CVE-2026-42897, a cross-site scripting flaw in Outlook Web Access (OWA). This vulnerability, disclosed by Microsoft on May 14, 2026, allows attackers to deploy a persistent JavaScript backdoor known as OWAReaper. The backdoor can survive credential rotations, browser restarts, and even full host re-imaging. Targeted entities include government bodies and organizations, indicating a significant scope of impact. The operation was confirmed to have exploited the flaw before Microsoft issued an emergency patch. The ongoing campaign raises concerns about the security of OWA users. As of July 30, 2026, the threat remains active.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 52d ago How this analysis works

Timeline

2026-05-14

CVE-2026-42897 published

Microsoft disclosed a cross-site scripting vulnerability in Outlook Web Access.

2026-05-15

CVE-2026-42897 added to CISA KEV

CISA confirmed active exploitation of the vulnerability shortly after its disclosure.

2026-07-30

TA488 campaign confirmed

TA488 linked to exploitation of CVE-2026-42897, targeting government organizations.

Cybersecuritynews

More articles in this cluster (3)

Threat Graph

16 entities, 25 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (3)

Laundry Bear
Ta488
Void Blizzard

Technique (8)

Malware
Zero-day Exploit
T1059.007 - JavaScript
T1078 - Valid Accounts
T1190 - Exploit Public-Facing Application
T1203 - Exploitation for Client Execution
T1505.003 - Web Shell
T1555.003 - Credentials From Web Browsers

Vulnerability (1)

CVE-2026-42897

Weakness (1)

Cwe-79 - Cross-site Scripting (xss)

Malware (1)

OWAReaper

Affected Platform (2)

Microsoft Exchange
Outlook Web Access

Relationships

Laundry Bear uses OWAReaper
Ta488 uses OWAReaper
Void Blizzard uses OWAReaper
Laundry Bear uses Malware
Laundry Bear uses Zero-day Exploit
Laundry Bear uses T1059.007 - JavaScript
Laundry Bear uses T1078 - Valid Accounts
Laundry Bear uses T1190 - Exploit Public-Facing Application
Ta488 uses Malware
Ta488 uses Zero-day Exploit
Ta488 uses T1059.007 - JavaScript
Ta488 uses T1078 - Valid Accounts
Ta488 uses T1190 - Exploit Public-Facing Application
Void Blizzard uses Malware
Void Blizzard uses Zero-day Exploit
Void Blizzard uses T1059.007 - JavaScript
Void Blizzard uses T1078 - Valid Accounts
Void Blizzard uses T1190 - Exploit Public-Facing Application
OWAReaper exploits CVE-2026-42897
CVE-2026-42897 targets Microsoft Exchange
CVE-2026-42897 targets Outlook Web Access
Laundry Bear related to Cwe-79 - Cross-site Scripting (xss)
Laundry Bear related to T1203 - Exploitation for Client Execution
Laundry Bear related to T1505.003 - Web Shell
Laundry Bear related to T1555.003 - Credentials From Web Browsers

Following this threat?

Track Laundry Bear, OWAReaper and CVE-2026-42897 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…

Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited…