Laundry Bear APT Exploits OWA XSS Flaw to Retain Mailbox Access Post-Rotation

The Russia-linked threat cluster tracked as Laundry Bear (also known as CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) has been weaponizing a now-patched cross-site scripting vulnerability in Microsoft Outlook Web Access (OWA) to maintain persistent access to compromised mailboxes even after organizations rotate credentials. Tracked as CVE-2026-42897 with a CVSS score of 8.1, the flaw was flagged by Microsoft as exploited in the wild as early as May 2026. According to Proofpoint researchers Greg Lesnewich, Stuart Del Caliz, Nick Attfield, Konstantin Klinger, Saher Naumaan, and Mark Kelly, the campaign began on July 22, 2026, and has struck U.S. and European government agencies alongside telecommunications, financial, hospitality, and aerospace organizations. The same actor was previously tied to the zero-day exploitation of CVE-2025-66376, an XSS defect in Zimbra's Classic UI, which triggered automatic payload deployment the moment a victim opened a booby-trapped email.

The new wave leans heavily on so-called "half-click" exploits, where simply opening or previewing a message in OWA is sufficient to trigger compromise, with no links or attachments required to raise user suspicion. Messages were dispatched from adversary-controlled Proton Mail accounts as well as previously hijacked legitimate addresses, and relied on deliberately vague lures such as supply chain analyses, tourism statistics, and gas market research to blend in with routine spam traffic. Once a recipient views the email in a vulnerable OWA build, a loader piece of JavaScript abuses the onload= event handler to parse the message body, assemble Base64-encoded fragments, and execute them as obfuscated JavaScript inside the mailbox context, granting the operators session-level foothold that survives password resets and MFA prompts.

Because this technique hijacks the authenticated browser session rather than stealing reusable credentials, standard remediation steps like forcing logouts, resetting passwords, and revoking OAuth tokens may not fully evict the intruder. Security teams should assume that any mailbox that received a malicious message while the OWA flaw was exploitable has potentially been exposed, and prioritize forensic review of mail rules, forwarding settings, and inbox folder permissions that could indicate post-exploitation tampering. Organizations can use an email breach checker to verify whether executive or IT-staff addresses have surfaced in known credential dumps, and run a privacy checkup across exposed admin endpoints to surface misconfigured Exchange and OWA instances.

Defenders should patch OWA to the latest vendor release, enforce strict session timeouts, restrict mailbox access via trusted IP ranges, and monitor for anomalous PowerShell, EWS, or Graph API activity originating from mail servers. Given Laundry Bear's tradecraft improvements and broadening targeting scope, organizations should also conduct a full password checker review for privileged accounts and audit any lingering webmail sessions, since credential rotation alone will not remove the malicious JavaScript planted inside the inbox environment.