OWAReaper Backdoor: How Laundry Bear Exploits CVE-2026-42897 for Persistent Exchange Mailbox Access

Microsoft disclosed the vulnerability on May 14, 2026, and issued a patch (CVSS 8.1, High severity) . However, many organizations had not applied the update by the time TA488's campaign began in late July, leaving the entry point open . The exploit has targeted U.S. and European government entities, as well as telecommunications, financial, hospitality, and aerospace sectors . Exchange Online is not affected — only on-premises Exchange Server deployments are vulnerable .

How OWAReaper Achieves Persistent Access

OWAReaper is a JavaScript browser-based implant that runs entirely within the OWA browser context and leaves no host-level file footprint on the victim's device . Its persistence relies on two independent mechanisms that reinforce each other.

1. Browser-Local Persistence via localStorage

OWAReaper stores an encrypted copy of itself in the browser's localStorage and modifies OWA's offline message cache with a hidden iframe . Because the implant lives in browser storage rather than on the filesystem, it survives browser reboots, operating system re-imaging, and full device wipe and restore — as long as the user, re-opens OWA, or the browser profile is re-synced via browser sync .

2. Server-Side Mailbox Permission Abuse

OWAReaper's most durable persistence mechanism operates server-side. It checks for installed Outlook add-ins with ReadWriteMailbox permissions . If found, it abuses those add-ins to steal OAuth tokens via the GetClientAccessToken operation request . Using the stolen token, the backdoor calls the Exchange UpdateFolder API to grant itself Owner-level permissions to the "Default" — a low-privilege preset alias in all Microsoft Exchange tenants — user on every mail folder in the mailbox .

This means any authenticated user in the same Exchange organization has full access to that mailbox . These permission changes are stored server-side in Exchange, not on the endpoint. Password resets, credential rotation, and device re-imaging have no effect on them . As Proofpoint warned: "This persistent access lives on the server-side and requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user's device will not evict the actor."

3. Stealth and Anti-Forensics

After execution, OWAReaper removes the exploit code from the stored email message on the Exchange server, reducing forensic visibility . It uses two command-and-control communication channels and two data exfiltration protocols to maintain resilient command-and-control .

Key Implications for Remediation

The original patch (CVE-2026-42897) closes the entry vector, but it does not revoke the Exchange folder permissions that OWAReaper already granted . Even fully patched organizations remain compromised if OWAReaper was deployed before patching. Effective remediation requires:

• Auditing and removing unauthorized Owner-level mailbox folder permissions on the Exchange server for mailboxes that may have been compromised .
• Clearing browser localStorage for OWA to remove the browser-resident copy of the implant .
• Investigating any suspicious Outlook add-ins with ReadWriteMailbox permissions .
• Rotating OAuth tokens that may have been stolen .

Organizations should also verify that the May 2026 Exchange security update has been applied across all on-premises servers, while recognizing that patching alone is insufficient if the backdoor was already deployed .