The Russian threat actor TA488 (Laundry Bear) has been exploiting CVE-2026-42897, a cross-site scripting (XSS) vulnerability (CVSS 8.1) in Microsoft Outlook Web Access (OWA), active since July 22, 2026. The attack chain uses 'half-click' exploits where simply opening/viewing a phishing email triggers compromise — no user interaction such as clicking links or opening attachments is required. Emails are sent from compromised accounts and adversary-controlled Proton Mail addresses, using generic lures (supply chain analyses, research updates, tourism/gas market metrics) to avoid suspicion. The exploit leverages the onload= event handler to parse the email body, assemble a Base64 fragment, and execute encoded JavaScript. Exploit trigger and payload blobs are hidden in social media icon HTML, with next-stage payload data stored after '#' symbols. The payload deployed is OWAReaper, a JavaScript browser-based implant that: (1) executes within the OWA reading pane; (2) uses Outlook APIs to rewrite the email on the Exchange server and remove exploit content; (3) disables OWA pop-ups and right-click; (4) creates a unique session key; (5) gathers target email address, username, and Outlook settings; (6) creates invisible DOM input elements to capture OWA saved credentials via browser autofill; (7) writes an encrypted version of itself and a decryption wrapper into browser localStorage for persistence across OWA tab opens; (8) checks for Outlook add-ins with ReadWriteMailbox permissions to steal OAuth tokens and grants itself Owner-level permissions to the Default user on every mail folder, allowing complete mailbox access to any authenticated user in the organization — this persistence is server-side and survives credential rotation and full device re-imaging; (9) creates a second persistence method by injecting a hidden iframe into messages stored in OWA's offline IndexedDB message cache, re-infecting upon opening cached emails. C2 uses two methods: querying GitHub's Commit Search API every 24 hours for commit messages containing the target's email address (commands encrypted with a hard-coded key and per-session AES key), and parsing inbound emails from TA488 operators with structure {target_email_address}{space}{Base64text} from IndexedDB. Supported commands include 'code' (replace OWAReaper toolkit), 'domn' (rotate C2 servers), and 'cmnd' (execute arbitrary JavaScript via eval()). Data exfiltration uses AES-CTR encrypted URI paths over HTTPS; fallback is DNS label tunneling within DNS queries to an actor-controlled domain. Infrastructure was created as early as March 2026, two months before Microsoft's disclosure of CVE-2026-42897, suggesting possible zero-day exploitation. OWAReaper is an evolution of the ZimReaper malware previously used against Zimbra (CVE-2025-66376), sharing significant source code and behavioral overlaps.