Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation

Russian threat actor Laundry Bear is exploiting CVE-2026-42897, an unpatched cross-site scripting flaw in Microsoft Outlook Web Access, to deploy a JavaScript backdoor called OWAReaper that persists inside the webmail client even after victims rotate their credentials. This attack is particularly dangerous because credential rotation — a standard incident response procedure — provides no relief once the backdoor is embedded, effectively nullifying one of the most common remediation steps organizations rely on. Compounding the threat, the malware actively rewrites Exchange server emails to erase forensic evidence of the exploit, blinding defenders and hindering investigation. This campaign highlights that unpatched internet-facing webmail infrastructure remains a high-value entry point for nation-state actors targeting government and critical sectors. Organizations cannot rely solely on credential hygiene when client-side persistence mechanisms bypass authentication entirely.