--- title: Russian hackers turn Exchange flaw into ‘half-click’... description: A Russia-aligned threat group (TA488/Void Blizzard/Laundry Bear) exploited CVE-2026-42897, a cross-site scripting flaw in Microsoft Exchange's Outlook Web... canonical: https://daily.dev/posts/russian-hackers-turn-exchange-flaw-into-half-click-mailbox-takeover-do72mdud0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Russian hackers turn Exchange flaw into ‘half-click’ mailbox takeover | daily.dev og:description: A Russia-aligned threat group (TA488/Void Blizzard/Laundry Bear) exploited CVE-2026-42897, a cross-site scripting flaw in Microsoft Exchange's Outlook Web... og:url: https://daily.dev/posts/russian-hackers-turn-exchange-flaw-into-half-click-mailbox-takeover-do72mdud0 og:image: https://api.daily.dev/og/posts/do72mduD0.png og:image:alt: Russian hackers turn Exchange flaw into ‘half-click’ mailbox takeover og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Russian hackers turn Exchange flaw into ‘half-click’ mailbox takeover **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary A Russia-aligned threat group (TA488/Void Blizzard/Laundry Bear) exploited CVE-2026-42897, a cross-site scripting flaw in Microsoft Exchange's Outlook Web Access, to deploy a browser-based JavaScript implant called OWAReaper. The attack required only viewing a crafted email in OWA — no clicks needed. OWAReaper erases exploit evidence from the server, harvests credentials via browser autofill, and can abuse Outlook add-in OAuth tokens to grant attacker-controlled accounts owner-level mailbox access. Critically, these permissions persist on the Exchange server even after password resets or endpoint rebuilds, making standard incident response insufficient. The campaign targeted US and European government agencies and companies in telecom, finance, hospitality, and aerospace. Defenders are advised to treat compromises as server-side identity incidents and correlate mailbox-permission changes, add-in activity, and OAuth events rather than relying solely on endpoint forensics. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Microsoft patches Exchange Server zero-day exploited in attacks](https://daily.dev/posts/microsoft-patches-exchange-server-zero-day-exploited-in-attacks-p0ic0hphn) · BleepingComputer · 0 upvotes · 0 comments - [Protecting Against Zero-Click Attacks](https://daily.dev/posts/protecting-against-zero-click-attacks-ge7fvclrn) · IT Security Guru · 0 upvotes · 0 comments --- Tags: [#microsoft](https://daily.dev/tags/microsoft), [#oauth](https://daily.dev/tags/oauth), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/russian-hackers-turn-exchange-flaw-into-half-click-mailbox-takeover-do72mdud0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Russian hackers turn Exchange flaw into ‘half-click’ mailbox takeover","url":"https://daily.dev/posts/russian-hackers-turn-exchange-flaw-into-half-click-mailbox-takeover-do72mdud0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/russian-hackers-turn-exchange-flaw-into-half-click-mailbox-takeover-do72mdud0"},"datePublished":"2026-07-30T10:49:11.506Z","dateModified":"2026-10-14T02:25:42.799Z","description":"A Russia-aligned threat group (TA488/Void Blizzard/Laundry Bear) exploited CVE-2026-42897, a cross-site scripting flaw in Microsoft Exchange's Outlook Web...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a028f00cda8e3a352acecd2fb1590664?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a028f00cda8e3a352acecd2fb1590664?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/russian-hackers-turn-exchange-flaw-into-half-click-mailbox-takeover-do72mdud0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"microsoft,oauth,security","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Russian hackers turn Exchange flaw into ‘half-click’ mailbox takeover"}]} ```