Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

TA488 leverages CVE-2026-42897 to plant OWAReaper in Outlook

Part of the CVE-2026-42897 story · since 15 May

Quiet for 13 weekslast report 30 Jul14 articles8 outlets
15 May · The Hacker News first9 Aug7 Sep6 OctNowThis article12th of 14
  • Fri 15 May, 07:20 UTC. The Hacker News, first report. Microsoft patches Exchange Server XSS spoof flaw CVE-2026-42897. Cites a CVE in CISA KEV.
  • Fri 15 May, 12:10 UTC. SecurityWeek, its first report on the story. Microsoft warns of zero day Exchange flaw CVE-2026-42897. Cites a CVE in CISA KEV.
  • Fri 15 May, 12:40 UTC. Infosecurity, its first report on the story. Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers. Cites a CVE in CISA KEV.
  • Fri 15 May, 14:30 UTC. Security Affairs, its first report on the story. CVE-2026-42897: Microsoft warns of active Exchange XSS flaw. Cites a CVE in CISA KEV.
  • Fri 15 May, 18:20 UTC. CISA, its first report on the story. CISA Adds MS Exchange XSS Flaw CVE-2026-42897 to KEV Catalog. Cites a CVE in CISA KEV.
  • Fri 15 May, 19:20 UTC. CISA. CISA flags CVE‑2026‑42897 in Exchange, urges immediate patch. Cites a CVE in CISA KEV.
  • Fri 15 May, 19:27 UTC. CISA. CISA adds Exchange XSS flaw CVE‑2026‑42897 to KEV list. Cites a CVE in CISA KEV.
  • Sat 16 May, 18:21 UTC. Security Affairs. CISA flags Exchange zero day flaw CVE-2026-42897 in KEV list. Cites a CVE in CISA KEV.
  • Mon 18 May, 15:42 UTC. The Hacker News. Microsoft Exchange zero day bug exploited in the wild. Cites a CVE in CISA KEV.
  • Mon 18 May, 22:12 UTC. Dark Reading, its first report on the story. Microsoft Exchange Zero-Day Under Attack, No Patch Available. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 07:07 UTC. SecurityWeek. Microsoft fixes active Exchange bug CVE-2026-42897.. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 14:43 UTC. SecurityOnline, its first report on the story. TA488 leverages CVE-2026-42897 to plant OWAReaper in Outlook. Cites a CVE in CISA KEV. This article, 12th of 14.
  • Wed 29 Jul, 15:20 UTC. Infosecurity. TA488 employs half‑click OWA exploit against government targets. Cites a CVE in CISA KEV.
  • Thu 30 Jul, 21:30 UTC. Ars Technica, its first report on the story. Russian hackers use Exchange XSS bug to plant OWAReaper. Cites a CVE in CISA KEV.

TA488, a Russia-aligned cyber-espionage group, utilized a half-click exploit (CVE-2026-42897) targeting Outlook Web Access (OWA) to deploy a browser implant named OWAReaper. The campaign, launched on July 22, 2026, aimed at US and European government, telecom, finance, hospitality, and aerospace sectors, marking a broad attack strategy.

Key characteristics include the exploit allowing installation without user interaction (just opening an email), and the malware's persistent nature, as it embeds itself within OWA settings. OWAReaper harvests sensitive OWA credentials and executes commands via encrypted channels. To mitigate risks, immediate patching and auditing are recommended.

How the story developed

All 14 articles
Quiet for 13 weekslast report 30 Jul14 articles8 outlets

14 articles from 8 outlets since 15 May. Quiet since 30 Jul. This was the 12th report, 75 days after the first.

Now15 May2226302581128 JulFirst reportThe Hacker News · 15 May, 07:20This article12th of 14 · day 75
  • Fri 15 May, 07:20 UTC. The Hacker News, first report. Microsoft patches Exchange Server XSS spoof flaw CVE-2026-42897. Cites a CVE in CISA KEV.
  • Fri 15 May, 12:10 UTC. SecurityWeek, its first report on the story. Microsoft warns of zero day Exchange flaw CVE-2026-42897. Cites a CVE in CISA KEV.
  • Fri 15 May, 12:40 UTC. Infosecurity, its first report on the story. Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers. Cites a CVE in CISA KEV.
  • Fri 15 May, 14:30 UTC. Security Affairs, its first report on the story. CVE-2026-42897: Microsoft warns of active Exchange XSS flaw. Cites a CVE in CISA KEV.
  • Fri 15 May, 18:20 UTC. CISA, its first report on the story. CISA Adds MS Exchange XSS Flaw CVE-2026-42897 to KEV Catalog. Cites a CVE in CISA KEV.
  • Fri 15 May, 19:20 UTC. CISA. CISA flags CVE‑2026‑42897 in Exchange, urges immediate patch. Cites a CVE in CISA KEV.
  • Fri 15 May, 19:27 UTC. CISA. CISA adds Exchange XSS flaw CVE‑2026‑42897 to KEV list. Cites a CVE in CISA KEV.
  • Sat 16 May, 18:21 UTC. Security Affairs. CISA flags Exchange zero day flaw CVE-2026-42897 in KEV list. Cites a CVE in CISA KEV.
  • Mon 18 May, 15:42 UTC. The Hacker News. Microsoft Exchange zero day bug exploited in the wild. Cites a CVE in CISA KEV.
  • Mon 18 May, 22:12 UTC. Dark Reading, its first report on the story. Microsoft Exchange Zero-Day Under Attack, No Patch Available. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 07:07 UTC. SecurityWeek. Microsoft fixes active Exchange bug CVE-2026-42897.. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 14:43 UTC. SecurityOnline, its first report on the story. TA488 leverages CVE-2026-42897 to plant OWAReaper in Outlook. Cites a CVE in CISA KEV. This article, 12th of 14.
  • Wed 29 Jul, 15:20 UTC. Infosecurity. TA488 employs half‑click OWA exploit against government targets. Cites a CVE in CISA KEV.
  • Thu 30 Jul, 21:30 UTC. Ars Technica, its first report on the story. Russian hackers use Exchange XSS bug to plant OWAReaper. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 14 articles as a list
  1. Fri 15 MayDay 07
    1. Microsoft patches Exchange Server XSS spoof flaw CVE-2026-4289707:20 · The Hacker News · First report · Known exploited CVE
    2. Microsoft warns of zero day Exchange flaw CVE-2026-4289712:10 · SecurityWeek · Known exploited CVE
    3. CISA Adds MS Exchange XSS Flaw CVE-2026-42897 to KEV Catalog18:20 · CISA · official · CISA alert · Known exploited CVE
    Show 4 more from 15 May
    1. Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers12:40 · Infosecurity · Known exploited CVE
    2. CVE-2026-42897: Microsoft warns of active Exchange XSS flaw14:30 · Security Affairs · Known exploited CVE
    3. CISA flags CVE‑2026‑42897 in Exchange, urges immediate patch19:20 · CISA · official · Known exploited CVE
    4. CISA adds Exchange XSS flaw CVE‑2026‑42897 to KEV list19:27 · CISA · official · Known exploited CVE
  2. Sat 16 MayDay 11
    1. CISA flags Exchange zero day flaw CVE-2026-42897 in KEV list18:21 · Security Affairs · Known exploited CVE

  3. Quiet for 2 days

    Mon 18 MayDay 32
    1. Microsoft Exchange zero day bug exploited in the wild15:42 · The Hacker News · Known exploited CVE
    2. Microsoft Exchange Zero-Day Under Attack, No Patch Available22:12 · Dark Reading · Known exploited CVE

  4. Quiet for 3 weeks

    Thu 11 JunDay 271
    1. Microsoft fixes active Exchange bug CVE-2026-42897.07:07 · SecurityWeek · Picked up again · Known exploited CVE

  5. Quiet for 7 weeks

    Wed 29 JulDay 752
    1. TA488 leverages CVE-2026-42897 to plant OWAReaper in Outlook14:43 · SecurityOnline · Picked up again · Known exploited CVE · This article, 12th of 14
    2. TA488 employs half‑click OWA exploit against government targets15:20 · Infosecurity · Known exploited CVE
  6. Thu 30 JulDay 761
    1. Russian hackers use Exchange XSS bug to plant OWAReaper21:30 · Ars Technica · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in