Table of Contents
Introduction
Email is one of the most important communication tools for businesses. Unfortunately, cybercriminals know this and are always looking for new ways to attack email systems. Recently, cybersecurity researchers discovered that a Russian hacking group is using a new Microsoft Exchange Outlook Web Access (OWA) vulnerability to secretly access email accounts.
This attack is dangerous because it allows hackers to stay inside an email account for a long time, even after the victim changes their password. Organizations using Microsoft Exchange need to understand this threat and take immediate action to protect their systems.
This vulnerability allows attackers to access email accounts just by sending a specially crafted email. No link clicking or attachment downloading is required.
What Is the Microsoft Exchange OWA Vulnerability?
The vulnerability, known as CVE-2026-42897, affects Microsoft Exchange Outlook Web Access (OWA). It is a Cross-Site Scripting (XSS) flaw that lets hackers run malicious JavaScript when someone opens a specially created email.
The scary part is that the victim does not need to click a link or download an attachment. Simply opening the email in Outlook Web Access is enough to trigger the attack. Because of this, security experts call it a "half-click" exploit.
CVE-2026-42897 is a serious security flaw that allows remote code execution through malicious JavaScript embedded in emails.
Who Is Behind the Attack?
Researchers believe the attack is being carried out by a Russian state-sponsored hacking group called Laundry Bear, also known as Void Blizzard.
The group has targeted government agencies, financial companies, telecommunications providers, aerospace organizations, and hospitality businesses in the United States and Europe. Their main goal is to steal sensitive information from email accounts.
How Does the Attack Work?
The hackers send an email that looks normal and contains no suspicious links or attachments. When the victim opens the email, hidden malicious code runs automatically because of the Exchange OWA vulnerability.
The attack then installs a backdoor called OWAReaper. This malware collects important information, including the user's email address, account details, and Outlook settings. It can also try to steal login credentials by using hidden fields that capture information automatically filled in by the browser.
To avoid being detected, the malware removes the malicious code from the email after it has been executed.
Why Is OWAReaper So Dangerous?
OWAReaper is more advanced than many other types of malware because it is designed to stay active for a long time.
- It changes mailbox permissions on the Exchange server instead of only stealing passwords. This means hackers may still have access to the mailbox even if the victim changes their password, enables multi-factor authentication (MFA), or reinstalls their computer.
- It can hide inside Outlook's offline email cache, allowing it to run again whenever the infected email is opened.
- It persists even after password resets, making it extremely difficult to remove completely.
How Does the Malware Communicate?
The attackers use different methods to send commands to the malware and steal data. One unusual technique involves hiding encrypted instructions inside GitHub commit messages. If that method does not work, the malware can receive commands through emails or send stolen information using encrypted internet traffic.
Using multiple communication methods makes it harder for security teams to detect and stop the attack.
How Can Organizations Stay Protected?
Businesses using Microsoft Exchange should take these security steps immediately:
- Install the latest Microsoft security updates — Microsoft has released patches for CVE-2026-42897. Apply them immediately.
- Monitor mailbox permission changes regularly — look for unexpected changes that could indicate compromise.
- Review Outlook add-ins with high-level permissions — remove any that are not approved.
- Enable Multi-Factor Authentication (MFA) — this adds an extra layer of security even if credentials are stolen.
- Train employees to report unusual emails — even if they seem harmless, any suspicious email should be reported to IT.
- Monitor login activity for suspicious behavior like logins from unusual locations or at odd hours.
- Conduct regular security audits of your Exchange environment.
If you suspect your Exchange server has been compromised, disconnect it from the internet immediately and contact a cybersecurity professional.
Final Thoughts
The new Microsoft Exchange OWA vulnerability shows that hackers are constantly finding smarter ways to target email systems. Since this attack only requires users to open an email, it can easily go unnoticed.
Keeping Microsoft Exchange servers updated, monitoring email accounts, and following good cybersecurity practices are the best ways to stay protected. As cyber threats continue to evolve, organizations should treat email security as a top priority to protect their sensitive business information.
If you need help securing your Microsoft Exchange environment or want to conduct a security assessment, contact SystemLogicIT today.