On July 22, one day before a multinational advisory named Laundry Bear in connection with the earlier Zimbra XSS campaign, the group pivoted to CVE-2026-42897, a cross-site scripting vulnerability in Outlook Web Access that Microsoft patched in May 2026. Proofpoint, which tracks the group as TA488, published its analysis today. The attack is a half-click exploit: opening an email in OWA is enough to trigger it. The emails carry no links or attachments and use deliberately unremarkable subject lines about supply chains, energy markets, tourism, and public health, designed to be opened and skimmed rather than reported. When a user opens a crafted message in the OWA reading pane, the Exchange server fails to sanitize HTML in the message body, allowing a hidden JavaScript loader to assemble and execute OWAReaper. OWAReaper is not an endpoint implant. It is a server-side browser implant that installs itself within OWA's structure. Proofpoint describes three persistence mechanisms: OWAReaper adds a malicious OWA add-in, poisons the offline IndexedDB message cache with a hidden iframe that reinfects reimaged hosts when the victim opens a cached email, and registers a synchronization hook so that the cached poisoned messages refresh on reconnect. Proofpoint states explicitly that OWAReaper requires deliberate removal from the Exchange server and that credential rotation and full re-imaging of the user's device will not evict it. Command and control uses DNS TXT record encoding for exfiltration, consistent with the group's ZimReaper malware from the earlier Zimbra campaign. Laundry Bear has been linked by US prosecutors to Yutek-NN, a Russian IT firm with documented connections to Russia's FSB. The group had been building campaign infrastructure since March 2026, two months before Microsoft patched the CVE, suggesting prior zero-day use.

Wiz Research published CosmosEscape yesterday after Microsoft completed full remediation in July 2026. The vulnerability chain began with a crafted query sent to the Gremlin graph query interface of a Cosmos DB account controlled by the attacker. Gremlin is a legitimate Cosmos DB feature for traversing graph databases. The crafted query caused a sandbox escape on the multi-tenant DB Gateway, the shared infrastructure layer that executes customer Cosmos DB queries on Microsoft's behalf. Code execution on the DB Gateway exposed the Cosmos Master Key, a platform-wide signing secret, and a regional account directory listing customer accounts. With the Cosmos Master Key, Wiz researchers could retrieve the primary account key of any Cosmos DB account on the service, giving full read and write access to that account's databases, including those configured with private endpoints or network isolation. Microsoft documentation confirms that databases backing Teams message data, Copilot conversation history, and Entra ID are hosted on Cosmos DB, meaning those databases were potentially accessible. Wiz stated it found Microsoft-internal database records during testing but did not access customer data. Microsoft hotfixed the vulnerable Gremlin entry point within 48 hours of the November 2025 report. The longer-term architectural fix, which eliminated the Cosmos Master Key entirely and rebuilt the gateway credential model so no single key has platform-wide access, completed in July 2026. Microsoft investigated and found no evidence of unauthorized access or customer impact. No CVE has been assigned. Wiz will present the full technical chain, including the crafted Gremlin query, at Black Hat USA on August 6.

Researcher Hakon Maloy published the technical details of a prompt injection vulnerability in Microsoft 365 Copilot on July 28, 144 days after reporting it to Microsoft. The attack embeds instructions in a Word document using white-on-white text or a font size of zero, making the instructions invisible to a human reader but visible to Copilot when it processes the document. When a user asks Copilot to summarize or analyze the document, Copilot follows the hidden instructions rather than simply reporting what the document contains. In the demonstrated scenario, the hidden text instructs Copilot to change specific numerical figures in the report, such as replacing a revenue number with a different value, and to copy those same instructions into the output document invisibly so that the manipulation propagates forward if anyone asks Copilot to process the generated report. The recipient receives a document with altered numbers and no indication that anything changed. No malware, no compromised account, no elevated permissions, and no network access are required. The attacker needs only to share a document with embedded hidden instructions with someone who will ask Copilot to process it. Microsoft has not patched the behavior as of the publication date. Maloy stated that he published the details after 144 days without a fix or CVE assignment.