Laundry Bear — OWAReaper (CVE-2026-42897)

Ankit Mehta@Secvyn

•updated Aug 5, 2026•4•0•6

Detects instances where a user accesses an Exchange email item and subsequently modifies, moves, or deletes the same item within a short 10-minute window using the same IP address. This behavior can be indicative of automated cleanup, unauthorized tampering, or mailbox manipulation.