Eine Sicherheitslücke in OWA ermöglicht durch Anzeigen von Mails das Ausführen von JavaScript-Code. Russische Akteure nutzen das aus.

Laundry Bear, also tracked as Void Blizzard and TA488, is using the CVE-2026-42897 Outlook Web Access XSS flaw in half-click email attacks to deliver the OWAReaper backdoor. The campaign targets government and industry organizations across the U.S. and Europe and uses advanced persistence, credential theft, and multi-channel command-and-control to maintain long-term mailbox access. #LaundryBear #VoidBlizzard #TA488 #CVE-2026-42897 #OWAReaper #MicrosoftExchange #OutlookWebAccess

At a glance Actor TA488 (Void Blizzard / Laundry Bear), Russia-aligned Activity Half-click XSS exploit of Outlook Web Access; browser implant Targets US and European government; telecom, finance, hospitality, aerospace Scale Broad campaign from 22 July 2026; infrastructure built March 2026 Status Attributed by Proofpoint; joint NSA/FBI reporting; no arrests Source Proofpoint Threat Research TL;DR Proofpoint tracked a new half-click…

TA488 launched a July 2026 campaign exploiting CVE-2026-42897 in Outlook Web Access to deliver the browser-based implant OWAReaper against government, telecommunications, finance, hospitality, and aerospace targets. OWAReaper provides stealthy persistence, credential theft, command execution, and exfiltration through HTTPS or DNS, using infrastructure such as acocdn[.]com, asecdns[.]com, dnsrecursive[.]eu, and tdndns[.]com. #TA488 #OWAReaper...

📢 𝙉𝙊𝙑𝙄𝘿𝘼𝘿𝙀: 𝗨𝗺𝗮 𝗻𝗼𝘃𝗮 𝗨𝗥𝗟 𝗽𝗮𝗿𝗮 𝗼 𝗢𝘂𝘁𝗹𝗼𝗼𝗸 𝗪𝗲𝗯! A Microsoft está oferecendo uma experiência ao cliente mais integrada e fluida e está anunciando uma nova URL para o Outlook na Web: 𝗼𝘂𝘁𝗹𝗼𝗼𝗸.𝗰𝗹𝗼𝘂𝗱.𝗺𝗶𝗰𝗿𝗼𝘀𝗼...