NewsProofpoint Threat Insight

    Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit

    Share
    Threat Research would like to thank the Proofpoint Cloudmark Authority team for their collaboration. Key Findings On 22 July 2026, one day prior to Proofpoint’s recent joint release with the NSA on Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear), the actor began a campaign abusing CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA). The campaign targeted US and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors. TA488 is doubling down on the use of “half-click” exploits – where…

    Linked advisories

    Affected vendors and products

    More on Cleaning

    Other advisories

    Source: https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit

    ID