Inside OWAReaper: How CVE-2026-42897 Enables Persistent Exchange Mailbox Compromise

This report analyzes CVE-2026-42897, a stored XSS in on-premises Microsoft Exchange OWA that TA488 actively exploited via a “half-click” HTML email to execute JavaScript in authenticated OWA sessions and deploy the OWAReaper browser implant; OWAReaper harvests credentials and EWS OAuth tokens, abuses Exchange APIs to grant persistent Owner permissions to the Default mailbox user, persists via browser LocalStorage/IndexedDB and server-side ACLs, and exfiltrates data using GitHub commits, CDN-relayed HTTPS, and DNS tunneling — the report includes technical reconstruction, PoC lab reproduction, IoCs, and recommended detection and remediation steps.