Outlook Webmail Half-Click Attacks: Why Opening an Email Can Be Enough

Proofpoint published new research on 29 July describing a campaign by TA488, also known as Laundry Bear or Void Blizzard, that abused CVE-2026-42897 in Outlook Web Access. The Record reports that the targeting included U.S. and European government entities plus telecommunications, financial, hospitality and aerospace organisations.

Proofpoint calls the technique a half-click exploit because simply opening the email in the vulnerable webmail client can begin the infection chain. The campaign delivered OWAReaper, a previously unknown JavaScript browser implant that runs inside the OWA browser context and is designed for persistent access and credential theft.

Many phishing defences train users not to click links or open attachments. That advice still matters, but this kind of webmail bug is more uncomfortable: the dangerous action may be opening or previewing a crafted message in a vulnerable webmail interface.

Proofpoint says OWAReaper used subtle persistence mechanisms and could survive browser restarts, credential rotation and endpoint re-imaging in some scenarios because the implant lived in the webmail context. That shifts the response from ordinary endpoint cleanup toward Exchange patching, mailbox investigation and careful remediation of affected webmail environments.

If you run on-premises Exchange, review Microsoft's July 2026 Exchange Server Security Updates and confirm whether your servers or management tools need updates. Microsoft says Exchange Online customers are already protected for the July update set, but organisations with any remaining on-premises Exchange footprint still need to inventory and update it.

For users, report suspicious messages even if you did not click anything. For administrators, look beyond endpoints: review mailboxes, webmail access logs, suspicious rules or forwarding, OAuth/app access, MFA prompts and any unusual webmail sessions. If mitigations were previously applied for CVE-2026-42897, follow Microsoft's guidance for removing them only after the July update is installed.

A VPN can protect the connection between a user's device and mail service on untrusted networks. It is useful for reducing local Wi-Fi snooping while travelling or working from a cafe.

A VPN does not sanitize malicious email HTML, patch Exchange, stop JavaScript that executes inside a vulnerable webmail session, or detect a mailbox implant. The controls that matter most here are server updates, webmail hardening, MFA, suspicious-session monitoring and fast reporting of odd messages.

The takeaway for ordinary readers is not to panic every time an email preview loads. It is to understand that account security is layered. Strong passwords, MFA and safe networks help, but service-side vulnerabilities can still create risk that only the provider or administrator can fix.

For small businesses still running Exchange, this is a useful moment to re-check whether on-premises mail is still worth the maintenance burden. If it is, patch cadence, health checks and incident playbooks need to be treated as core business operations, not occasional IT housekeeping.