Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation

The Russian threat actors recently linked to the exploitation of a now-patched vulnerability in Zimbra have been observed exploiting another vulnerability, this time in Microsoft Outlook Web Access (OWA), to target U.S. and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors. The activity, which began on July 22, 2026, involves the

The article reports that the Russian-linked group Laundry Bear is exploiting CVE-2026-42897, a high-severity XSS flaw in Microsoft Outlook Web Access (OWA), using a browser-based JavaScript implant called OWAReaper to maintain persistent mailbox access even after credential rotation and device re-imaging.[1][2] The campaign targets US and European government entities and major sectors, and can grant full mailbox access to any authenticated user in the organization.[1][2] From a RealGround perspective, this illustrates a critical SaaS and webmail supply-chain exposure where persistent, browser-resident implants can silently hijack communication channels that AI agents or copilots rely on, enabling long-term data exfiltration or manipulation of email-based workflows. Organizations should continuously red-team AI and automation flows around SaaS mail systems, model how such implants could drive malicious instructions or data into AI agents, and ensure robust isolation, monitoring, and hardening of browser and webmail environments that interact with AI systems.