Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit
MentionsProofpoint
Threat Research would like to thank the Proofpoint Cloudmark Authority team for their collaboration. Key Findings On 22 July 2026, one day prior to Proofpoint’s recent joint release with the NSA on Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear), the actor began a campaign abusing CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA).
Summary from Proofpoint Threat Insight.
Explained
The technology and terms in this story. Learn more
- WeaknessCross-site scripting · XSSGetting a website to run an attacker's JavaScript in other visitors' browsers.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.