Skip to content
OriginalSign in
Image: Infosecurity

Infosecurity

TA488 employs half‑click OWA exploit against government targets

Part of the CVE-2026-42897 story · since 15 May

Quiet for 13 weekslast report 30 Jul14 articles8 outlets
15 May · The Hacker News first9 Aug7 Sep6 OctNowThis article13th of 14
  • Fri 15 May, 07:20 UTC. The Hacker News, first report. Microsoft patches Exchange Server XSS spoof flaw CVE-2026-42897. Cites a CVE in CISA KEV.
  • Fri 15 May, 12:10 UTC. SecurityWeek, its first report on the story. Microsoft warns of zero day Exchange flaw CVE-2026-42897. Cites a CVE in CISA KEV.
  • Fri 15 May, 12:40 UTC. Infosecurity, its first report on the story. Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers. Cites a CVE in CISA KEV.
  • Fri 15 May, 14:30 UTC. Security Affairs, its first report on the story. CVE-2026-42897: Microsoft warns of active Exchange XSS flaw. Cites a CVE in CISA KEV.
  • Fri 15 May, 18:20 UTC. CISA, its first report on the story. CISA Adds MS Exchange XSS Flaw CVE-2026-42897 to KEV Catalog. Cites a CVE in CISA KEV.
  • Fri 15 May, 19:20 UTC. CISA. CISA flags CVE‑2026‑42897 in Exchange, urges immediate patch. Cites a CVE in CISA KEV.
  • Fri 15 May, 19:27 UTC. CISA. CISA adds Exchange XSS flaw CVE‑2026‑42897 to KEV list. Cites a CVE in CISA KEV.
  • Sat 16 May, 18:21 UTC. Security Affairs. CISA flags Exchange zero day flaw CVE-2026-42897 in KEV list. Cites a CVE in CISA KEV.
  • Mon 18 May, 15:42 UTC. The Hacker News. Microsoft Exchange zero day bug exploited in the wild. Cites a CVE in CISA KEV.
  • Mon 18 May, 22:12 UTC. Dark Reading, its first report on the story. Microsoft Exchange Zero-Day Under Attack, No Patch Available. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 07:07 UTC. SecurityWeek. Microsoft fixes active Exchange bug CVE-2026-42897.. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 14:43 UTC. SecurityOnline, its first report on the story. TA488 leverages CVE-2026-42897 to plant OWAReaper in Outlook. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 15:20 UTC. Infosecurity. TA488 employs half‑click OWA exploit against government targets. Cites a CVE in CISA KEV. This article, 13th of 14.
  • Thu 30 Jul, 21:30 UTC. Ars Technica, its first report on the story. Russian hackers use Exchange XSS bug to plant OWAReaper. Cites a CVE in CISA KEV.

A Russia-aligned espionage group, TA488 (also known as Void Blizzard or Laundry Bear), has re-emerged, employing a sophisticated half-click exploit to launch persistent attacks on Outlook Web Access (OWA). Using a cross-site scripting flaw (CVE-2026-42897), they initiated a campaign targeting US and European government entities as well as various sectors including telecommunications and finance.

The group employed mundane email lures and their payload, OWAReaper, operated entirely within the OWA reading pane, allowing it to bypass traditional security measures. Key tactics included server-side persistence, stealing OAuth tokens for elevated privileges, and using a hidden iframe to ensure reinfection after device reimaging. Exfiltration methods included GitHub messages and DNS tunneling, highlighting the group's advanced capabilities. Organizations are urged to implement security updates and revoke specific permissions to mitigate risks.

How the story developed

All 14 articles
Quiet for 13 weekslast report 30 Jul14 articles8 outlets

14 articles from 8 outlets since 15 May. Quiet since 30 Jul. This was the 13th report, 75 days after the first.

Now15 May2226302581128 JulFirst reportThe Hacker News · 15 May, 07:20This article13th of 14 · day 75
  • Fri 15 May, 07:20 UTC. The Hacker News, first report. Microsoft patches Exchange Server XSS spoof flaw CVE-2026-42897. Cites a CVE in CISA KEV.
  • Fri 15 May, 12:10 UTC. SecurityWeek, its first report on the story. Microsoft warns of zero day Exchange flaw CVE-2026-42897. Cites a CVE in CISA KEV.
  • Fri 15 May, 12:40 UTC. Infosecurity, its first report on the story. Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers. Cites a CVE in CISA KEV.
  • Fri 15 May, 14:30 UTC. Security Affairs, its first report on the story. CVE-2026-42897: Microsoft warns of active Exchange XSS flaw. Cites a CVE in CISA KEV.
  • Fri 15 May, 18:20 UTC. CISA, its first report on the story. CISA Adds MS Exchange XSS Flaw CVE-2026-42897 to KEV Catalog. Cites a CVE in CISA KEV.
  • Fri 15 May, 19:20 UTC. CISA. CISA flags CVE‑2026‑42897 in Exchange, urges immediate patch. Cites a CVE in CISA KEV.
  • Fri 15 May, 19:27 UTC. CISA. CISA adds Exchange XSS flaw CVE‑2026‑42897 to KEV list. Cites a CVE in CISA KEV.
  • Sat 16 May, 18:21 UTC. Security Affairs. CISA flags Exchange zero day flaw CVE-2026-42897 in KEV list. Cites a CVE in CISA KEV.
  • Mon 18 May, 15:42 UTC. The Hacker News. Microsoft Exchange zero day bug exploited in the wild. Cites a CVE in CISA KEV.
  • Mon 18 May, 22:12 UTC. Dark Reading, its first report on the story. Microsoft Exchange Zero-Day Under Attack, No Patch Available. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 07:07 UTC. SecurityWeek. Microsoft fixes active Exchange bug CVE-2026-42897.. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 14:43 UTC. SecurityOnline, its first report on the story. TA488 leverages CVE-2026-42897 to plant OWAReaper in Outlook. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 15:20 UTC. Infosecurity. TA488 employs half‑click OWA exploit against government targets. Cites a CVE in CISA KEV. This article, 13th of 14.
  • Thu 30 Jul, 21:30 UTC. Ars Technica, its first report on the story. Russian hackers use Exchange XSS bug to plant OWAReaper. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 14 articles as a list
  1. Fri 15 MayDay 07
    1. Microsoft patches Exchange Server XSS spoof flaw CVE-2026-4289707:20 · The Hacker News · First report · Known exploited CVE
    2. Microsoft warns of zero day Exchange flaw CVE-2026-4289712:10 · SecurityWeek · Known exploited CVE
    3. CISA Adds MS Exchange XSS Flaw CVE-2026-42897 to KEV Catalog18:20 · CISA · official · CISA alert · Known exploited CVE
    Show 4 more from 15 May
    1. Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers12:40 · Infosecurity · Known exploited CVE
    2. CVE-2026-42897: Microsoft warns of active Exchange XSS flaw14:30 · Security Affairs · Known exploited CVE
    3. CISA flags CVE‑2026‑42897 in Exchange, urges immediate patch19:20 · CISA · official · Known exploited CVE
    4. CISA adds Exchange XSS flaw CVE‑2026‑42897 to KEV list19:27 · CISA · official · Known exploited CVE
  2. Sat 16 MayDay 11
    1. CISA flags Exchange zero day flaw CVE-2026-42897 in KEV list18:21 · Security Affairs · Known exploited CVE

  3. Quiet for 2 days

    Mon 18 MayDay 32
    1. Microsoft Exchange zero day bug exploited in the wild15:42 · The Hacker News · Known exploited CVE
    2. Microsoft Exchange Zero-Day Under Attack, No Patch Available22:12 · Dark Reading · Known exploited CVE

  4. Quiet for 3 weeks

    Thu 11 JunDay 271
    1. Microsoft fixes active Exchange bug CVE-2026-42897.07:07 · SecurityWeek · Picked up again · Known exploited CVE

  5. Quiet for 7 weeks

    Wed 29 JulDay 752
    1. TA488 leverages CVE-2026-42897 to plant OWAReaper in Outlook14:43 · SecurityOnline · Picked up again · Known exploited CVE
    2. TA488 employs half‑click OWA exploit against government targets15:20 · Infosecurity · Known exploited CVE · This article, 13th of 14
  6. Thu 30 JulDay 761
    1. Russian hackers use Exchange XSS bug to plant OWAReaper21:30 · Ars Technica · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in