On August 1, 2026, I published Part 2 of this series — an analysis of five post-compromise capabilities enabled by persistent Zimbra mailbox access, and a datestamped 60-day forecast of where the campaign would go next. One of the specific predictions in that forecast: TA488 would pivot from self-hosted Zimbra and Roundcube installations to Microsoft infrastructure, specifically Outlook Web Access, because the target population in government and aerospace increasingly runs Exchange.
The forecast was correct. On July 22, 2026 — nine days before Part 2 published, while I was still writing it — TA488 launched a new wave of attacks against Microsoft Outlook Web Access. The campaign deployed a previously unknown browser implant called OWAReaper, which Proofpoint describes as the most sophisticated backdoor delivered via half-click exploits to date. It is an evolution of ZimReaper, the implant documented in Part 1, sharing significant source code and behavioral overlaps while adding persistence mechanisms that survive both credential rotation and complete device reimaging.
The timing matters because it confirms the pattern, not the prediction. I did not know on August 1 that OWAReaper had already launched nine days earlier. What I did know was that TA488's operational history — four months of Zimbra zero-day exploitation before disclosure, deliberate actor discipline, targeted collection against government and aerospace — made the Microsoft pivot structurally predictable. The same actor, the same technique, the same intelligence objectives, pointed at the next logical target. The forecast held because the pattern was sound.
Series context: Part 1 documented the half-click exploit — opening an email in a vulnerable Zimbra installation fires JavaScript that steals credentials, 2FA codes, and 90 days of email with zero interaction from the victim. Part 2 analyzed five post-compromise capabilities enabled by persistent mailbox access and published a 60-day forecast. This Part 3 documents where the campaign went next — the technique evolution, the new target platform, and what OWAReaper does that ZimReaper could not.
Part 2 closed with five datestamped predictions about where the campaign would go in the 60 days following August 1, 2026. Three of those predictions are directly testable against the OWAReaper campaign that was already underway when Part 2 published. The comparison is uncomfortable in the best possible way — not because the prediction was impressive, but because the pattern was that readable.
None of this required sophisticated analysis. Actors with demonstrated capability and specific intelligence objectives do not stop when a campaign is disclosed — they evolve. The disclosure of Operation RoundPress on July 23 did not interrupt TA488. OWAReaper launched the day before the joint Proofpoint/NSA advisory went public. The pattern was already in motion.
ZimReaper, documented in Part 1, used @import tag-splitting to bypass Zimbra's HTML sanitizer. The technique fragments HTML tags with CSS @import directives — the sanitizer strips the @import sequences, and the browser reassembles the remaining characters into valid executable markup. It is detectable because the fragmentation pattern is distinctive and the @import sequences leave artifacts in the email HTML.
OWAReaper uses a completely different technique — one that is harder to detect because it exploits valid HTML semantics rather than sanitizer confusion.
src attribute of each image tag contains a valid Base64-encoded image followed by a # symbol and a payload fragment. The browser stops parsing the src at the # — it renders a normal image. The payload fragment after the # is ignored by the browser's image renderer but is readable by JavaScript as part of the DOM.onload= event handler — a JavaScript execution trigger that fires when the element loads. OWA's HTML sanitizer was supposed to strip onload= and other event handlers from email content. CVE-2026-42897 is specifically a failure in that sanitization — OWA does not adequately sanitize HTML in the message body when rendered in the reading pane. The onload= handler fires the moment the victim opens the email. No click required.onload= handler executes a small JavaScript loader that queries the DOM for all image tags in the email body, reads the content after each # symbol in their src attributes, concatenates those fragments in order, Base64-decodes the result, and executes it as JavaScript inside the victim's authenticated OWA browser session. The full OWAReaper implant is assembled in memory from fragments that individually look like corrupted image data.These are not two separate campaigns. They are two generations of the same tool, built by the same actor, using the same half-click exploit philosophy, refined over eighteen months of operational learning. The comparison between them reveals how TA488 incorporates defensive feedback into its tooling — each new version addresses the detection gaps that closed the previous one.
Target: Zimbra, Roundcube, mDaemon, SOGo — self-hosted webmail
CVE: CVE-2025-66376 (Zimbra) — exploited as zero-day for ~4 months
Technique: @import tag-splitting — CSS fragments reassemble into executable markup after sanitizer strips @import sequences
Detection signal: Distinctive @import fragmentation pattern in email HTML — detectable at the email layer
Persistence: Credential theft — access lost after password rotation
Self-cleaning: No — exploit content remains in email
Post-compromise: Credential theft, 2FA interception, calendar C2 (HOLLOWGRAPH)
Target: Microsoft Outlook Web Access — on-premises Exchange
CVE: CVE-2026-42897 (OWA XSS) — infrastructure created March 2026, disclosed May 14
Technique: onload= event handler + Base64 fragments hidden after # in image src attributes — no sanitizer confusion required
Detection signal: Fragments hidden inside valid image attributes — significantly harder to detect at email layer
Persistence: Owner-level Exchange folder permissions — survives password reset, session revocation, endpoint reimaging
Self-cleaning: Yes — rewrites email on Exchange server to remove exploit content immediately after execution
Post-compromise: Full persistent mailbox access, OAuth token theft, two C2 channels, two exfiltration protocols
Every weakness that made ZimReaper detectable has been addressed in OWAReaper. The tag-splitting pattern that anchored the RoundPress detection rule — and the rule I submitted to Sublime Security's open-source ruleset — does not appear in OWAReaper. The exploit content that would survive in the victim's inbox for forensic analysis is immediately overwritten. The access that would be revoked by a password reset now lives on the Exchange server independently of credentials.
Detection gap: The @import tag-splitting rule submitted to Sublime Security in PR #4981 covers ZimReaper delivery specifically. OWAReaper uses a different technique — onload= event handlers and Base64 payload fragments in image src attributes — that requires a separate detection rule. Both rules are needed. Neither covers the other's attack surface. A companion rule targeting OWAReaper delivery patterns is in development and will be submitted as a fast-follow PR.
For organizations running on-premises Exchange OWA, the standard credential-reset incident response is insufficient. The following actions are specific to OWAReaper and are not covered by most IR playbooks.
| Action | Why | Priority |
|---|---|---|
| Apply CVE-2026-42897 patches to all on-premises Exchange servers | Microsoft shipped emergency mitigations and a permanent patch on June 9, 2026. Unpatched OWA instances remain vulnerable to initial compromise. | IMMEDIATE |
| Audit Exchange folder permissions — specifically Default and Anonymous | OWAReaper grants Owner-level permissions to the Default user on every mail folder. Standard credential reset does not remove these. Explicit permission audit and revocation on Exchange is required. | IMMEDIATE |
| Review and revoke Outlook add-in tokens with ReadWriteMailbox permissions | OWAReaper uses installed add-ins with ReadWriteMailbox to steal OAuth tokens and establish persistence. Review all add-ins with this permission scope and revoke any that cannot be verified as legitimate. | IMMEDIATE |
| Clear OWA offline cache and browser storage on potentially affected endpoints | OWAReaper establishes persistence in browser storage in addition to Exchange server permissions. Clearing OWA offline cache and browser localStorage/IndexedDB removes this layer. | HIGH |
| Identify OWA users and messages opened during the exposure window | The exposure window extends back to March 2026 if zero-day exploitation is confirmed. Exchange logs will show which users opened emails in OWA during this period. | HIGH |
| Preserve browser evidence before remediation | OWAReaper rewrites the malicious email to remove exploit content. Browser localStorage and IndexedDB may contain implant artifacts that are not preserved by standard email forensics. | HIGH |
| Confirm hybrid Exchange inventory | "We use Microsoft 365" is not a complete answer. Identify any on-premises Exchange OWA endpoints including management tooling. CVE-2026-42897 affects on-premises OWA, not Exchange Online. | HIGH |
The previous forecast held. The pattern that generated it has not changed. TA488 is an actor with demonstrated zero-day capability, operational discipline, and specific intelligence collection objectives against government, aerospace, and critical infrastructure targets. OWAReaper is not the end of this campaign — it is the current generation of a maturing toolset.
The following observations about the next 60 days are analytical hypotheses, not confirmed intelligence. They are datestamped August 24, 2026.
Forecast — August 24, 2026
1. Cloud pivot: CVE-2026-42897 affects on-premises Exchange OWA. As organizations patch and migrate to Exchange Online, TA488 will need a new initial access vector for cloud-hosted OWA. Expect research into Exchange Online's HTML sanitization behavior — the same class of vulnerability in a cloud-managed service would have significantly broader impact.
2. Add-in supply chain: OWAReaper's persistence mechanism requires a pre-installed Outlook add-in with ReadWriteMailbox permissions to steal OAuth tokens. TA488 may move toward compromising legitimate add-ins — the same supply chain pattern documented in the npm ecosystem — to ensure the persistence prerequisite is already in place before the half-click exploit fires.
3. Self-cleaning will become standard: OWAReaper's most significant operational innovation is the immediate deletion of exploit content from the Exchange server after execution. This technique — using the victim's own authenticated APIs to destroy evidence — will appear in other implant families. Defenders who rely on mailbox forensics to identify compromise will face increasing blind spots.
This analysis is based on publicly available information including Proofpoint's "Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit" (July 30, 2026), Bleeping Computer's OWAReaper coverage (July 30, 2026), Breachroad's CVE-2026-42897 technical analysis, and Hacker News and Cyber Press reporting on the campaign. The forecast in Section 07 represents independent analytical hypothesis — not confirmed intelligence — and is datestamped August 24, 2026. The detection gap noted in Finding 5 reflects a rule currently in development for submission to Sublime Security's open-source ruleset as a companion to PR #4981. Part 1 of this series is available at yanaivanov.com/analysis/roundpress_analysis.html. Part 2 is available at yanaivanov.com/analysis/roundpress_part2.html.
I'm a security researcher in Connecticut. Analysis is the part I love: tracing threat actor behavior, pulling apart supply chain attacks, and following evidence even when it lands on "unknown." Before security I spent 15 years designing enterprise software. I contribute detection rules to Sublime Security's open-source production ruleset. Security+ in progress. Everything here is independent work, shared as a contribution to the security community.