Anoymask

TA488 OWAReaper: A "Half-Click" Attack that Adds Persistence Inside OWA Just by Opening an Email

1. Basic Information

2. One-Line Summary

This is an attack where viewing a crafted email in OWA runs JavaScript, leaves no file on the device, achieves persistence in both the browser and Exchange, and steals saved credentials, OAuth tokens, and mailbox permissions.

3. Attack Flow

  1. A compromised account sends a normal informational email with no URLs or attachments.
  2. The victim opens the email in the OWA reading pane.
  3. CVE-2026-42897 triggers an onload event, and reconstructs Base64 JavaScript from image fragments in the email body.
  4. OWAReaper runs in the OWA browser context and deletes the malicious parts from the original email.
  5. It collects browser autofill IDs and passwords using an invisible DOM input field.
  6. It hides its encrypted self inside OWA settings to run again when OWA syncs and restores.
  7. It steals OAuth tokens via a privileged Outlook add-in.
  8. It gives Owner permissions to the Default principal on all mail folders, allowing continuous access from another authenticated account in the same organization.
  9. It embeds an iframe into the IndexedDB offline mail cache to reinfect it.
  10. It receives commands from GitHub commit messages or attacker emails, and sends data through multiple paths.

4. Attacker Position and Execution Location

  • Delivery and C2 happen from outside compromised email accounts, GitHub, and attacker emails.
  • The exploit and implant run inside the victim's OWA browser tab.
  • Part of the persistence stays in mailbox permissions and settings on Exchange, and does not disappear when you reimage the device.

5. What Victims and Administrators See

  • To the user, it looks like a normal informational email with no attachments or links.
  • Because the malicious code disappears from the email body after opening, it may look like a normal email during post-checks.
  • EDR shows no executable files or typical child processes.
  • For administrators, it can show up as folder permission changes, OWA setting changes, GitHub API traffic, and strange email API activity.

6. Success and Failure Conditions

Success Conditions

  • An unpatched OWA processes the crafted HTML.
  • The user views the target email in OWA.
  • JavaScript, localStorage, IndexedDB, and OWA sync are available.
  • Stealing tokens requires an add-in with ReadWriteMailbox permissions.

Failure Conditions

  • CVE-2026-42897 is patched.
  • Email gateways or OWA clean the malicious HTML.
  • Browser autofill is disabled and the required add-in does not exist.
  • Exchange audits catch permission changes early and remove server-side settings.

7. What Happens on Success

Saved credentials and OAuth tokens are stolen, and the attacker can search and control emails. With Owner permissions and multiple browser persistence methods, mailbox compromise can continue even after changing passwords or rebuilding the device.

8. Observable Logs

  • Email: Receiving an email with a common subject, body rewriting right after opening, and command emails from the attacker.
  • Proxy/SWG/DNS: Periodic traffic from the OWA tab to the GitHub Commit Search API, and traffic to known C2 and destination servers.
  • Endpoint/EDR: Few file traces. You must check browser localStorage, IndexedDB, and extension/add-in usage.
  • Identity/IdP: OAuth token creation and use, and access to the target mailbox from a different account in the same organization.
  • SaaS/Cloud: Exchange folder ACL with Default:Owner, and suspicious changes to OWA user settings.
  • Network: XSS, beacons, and transmission patterns matching ET Rules 2071330 to 2071333.

9. Attack Success Judgment

  • Contact Only: Malicious email received, unopened.
  • User Action: Opened in the OWA reading pane.
  • Initial Execution: JavaScript reconstruction after onload, self-deletion of email body, session key creation.
  • Malware or Auth Success: localStorage persistence, credentials or OAuth tokens obtained.
  • Data Theft & Session Compromise: C2 response, external sending of emails, tokens, and settings.
  • Subsequent Compromise Confirmation: Owner granted to Default, mailbox access by another account, reinfection after reimaging.

10. Investigation Playbook

  • Trigger: CVE-2026-42897 signature, target subject, OWA to GitHub API, abnormal mail folder ACL.
  • Initial Check: Preserve the original email, delivery, and open times, and compare server-side body history with client cache.
  • Device: Collect browser profiles, localStorage, IndexedDB, OWA cache, saved credentials, and add-ins.
  • Auth & Cloud: Audit OAuth tokens, add-in permissions, OWA settings, all folder ACLs, and access from other accounts.
  • Subsequent Actions: Sequence GitHub API searches, command emails, email searches, forwarding, deletion, and external sending.
  • Containment: Apply patches, quarantine malicious emails, revoke tokens, change credentials, disable add-ins, and remove ACLs, OWA settings, and caches.
  • Status Categories: Delivered / Opened / Script Executed / Persistence Established / Token or Credential Stolen / Mailbox Access Confirmed / Exfiltration Confirmed.

11. Defense and Detection Ideas

  • Single Event: Owner granted to Default, OWA tab calling GitHub Commit Search API, long encrypted string in OWA settings.
  • Timeline Correlation: Target email opened -> Body changed -> OWA settings changed -> ACL changed -> GitHub API/C2 traffic.
  • Hunting: Check all mailboxes for Default:Owner, matching subjects since 2022-07-22, and suspicious iframes in OWA settings and IndexedDB.
  • Missing Logs: Without email opens, folder ACLs, add-in tokens, and browser storage logs, determining success is difficult.
  • Priority Actions: Exchange updates, external email HTML control, mailbox audits, phishing-resistant auth, add-in least privilege.

12. Facts / Inference / Hypothesis

Facts

  • Proofpoint confirmed that TA488 exploited CVE-2026-42897 starting from 2026-07-22.
  • OWAReaper runs inside OWA and uses localStorage, mail caches, and server-side ACLs.
  • C2 has two paths: GitHub commit messages and received emails.

Inference

  • Initializing the device alone is not enough; incident response must include the Exchange tenant side.
  • Email detection relying only on URLs and attachments easily misses initial contact.

Hypothesis

  • Combining OWA setting changes and ACL changes with email open events allows high-confidence detection.

13. MITRE ATT&CK Mapping

  • High Confidence: T1566.001 Spearphishing Attachment equivalent malicious email (sub-technique strictly does not match due to no attachment), T1203 Exploitation for Client Execution, T1056.002 Input Capture: GUI Input Capture, T1528 Steal Application Access Token, T1098 Account Manipulation, T1114 Email Collection, T1102.003 One-Way Communication.
  • Medium Confidence: T1539 Steal Web Session Cookie, T1556 Modify Authentication Process, T1071.001 Web Protocols.

14. Unknowns and Additional Investigation

  • Affected Exchange builds and patch status
  • Scope of actually stolen emails and credentials
  • C2 infrastructure outside of GitHub and email
  • Global targets and victims

15. Impact on SOCs

Organizations in government, telecommunications, finance, hospitality, and aerospace are targets, making this relevant to enterprises worldwide. Organizations using on-premises Exchange or OWA must include Exchange audits, browser storage, and mailbox ACLs in their SOC investigation scope, not just endpoint EDR.

16. Summary by Role

  • For SOCs: Correlate email opens, OWA settings, ACLs, and GitHub APIs in a timeline. Do not assume systems are safe just because there are no device traces.
  • For Administrators: Update Exchange and check all folder ACLs, add-ins, tokens, and OWA settings.
  • For Users: Even without attachments or links, report unfamiliar informational emails if opened in OWA.