TA488 opened the campaign on July 22, 2026, sending a high volume of emails from a series of compromised accounts to organizations across the government, telecommunications, financial, hospitality, and aerospace sectors in the United States and Europe. The goal was for a recipient to open and skim the message, then dismiss it as junk without reporting it. The email body itself is the weapon: it exploits CVE-2026-42897, a flaw in which the Exchange server fails to properly sanitize HTML in the message body. A small JavaScript loader uses an onload event handler to parse the rest of the body, reassemble a Base64 fragment hidden in social-media icon URLs after a # character, and execute it. Because opening the email in Outlook Web Access is enough to trigger everything, this is classified as a "half-click" exploit.

Execution happens entirely inside the OWA reading pane. Once the decoded payload runs, it deploys OWAReaper, a JavaScript implant that is an evolution of TA488's earlier ZimReaper malware. OWAReaper immediately uses Outlook APIs to rewrite the malicious email on the Exchange server and strip out the exploit content, while disabling OWA pop-ups and right-click functionality so its activity is harder to notice. It generates a per-target session key and collects the account's email address, username, and Outlook settings. For persistence, it writes an encrypted copy of itself and a decryption wrapper into the browser's localStorage under a legitimate OWA settings field. OWA's normal page-sync flow then re-executes the implant automatically every time the user opens an OWA tab, and the malware leaves no file on the host.

To deepen its foothold, OWAReaper creates two invisible input elements in the DOM and waits for the browser's autofill to populate them, capturing the user's saved OWA username and password. It then looks for installed Outlook add-ins that hold ReadWriteMailbox permissions and abuses them, calling GetClientAccessToken to steal OAuth tokens. Next, it calls UpdateFolder to grant Owner-level permissions on every mail folder to the "Default" user, a low-permission alias present in all Exchange tenants — effectively handing mailbox access to any authenticated account in the same organization. Because the permission change lives on the Exchange server, rotating the victim's credentials or even fully re-imaging their device does not remove the actor's access, which must be deliberately stripped from the server. As a further fallback, OWAReaper injects a hidden iframe into messages cached in OWA's offline IndexedDB store, so the implant re-infects the target whenever a poisoned cached email is reopened.

OWAReaper supports two command-and-control channels and two exfiltration paths. For commands, it queries GitHub's Commit Search API every 24 hours for specially crafted commit messages keyed to the target's email address, decrypting them with AES-CTR using a hardcoded key plus a per-session key; the observed command types are code, domn, and cmnd. Alternatively, it parses inbound attacker emails from IndexedDB every five minutes, matching a specific message structure. For exfiltration, the primary route is HTTPS with AES-CTR-encrypted URI paths, relayed through legitimate image CDN services and ultimately fetched from the actor domain; if that fails it beacons directly to the C2. When the HTTPS route fails entirely, OWAReaper falls back to DNS tunneling, AES-CTR-encrypting the data, Base32-encoding it, and splitting it across the subdomain labels of an actor-controlled domain. Unlike ZimReaper, it does not mass-exfiltrate the mailbox, likely to reduce noise and improve operational security.