Russian Zero-Clicks Empty Zimbra Webmail Without a Single Click

An XSS bug in Zimbra Classic UI let a Russian espionage group steal 90 days of email and 2FA codes just by viewing a message

On July 23, 2026, the NSA, FBI, CISA, and twelve international agencies published a joint advisory confirming what private researchers had tracked for months: a Russian state-backed espionage group exploited the zero-day vulnerability CVE-2025-66376 in Zimbra Collaboration Suite for at least five months, from July 2025 until the patch release in November 2025. The technique requires no link clicks or attachment opens. Simply opening or previewing a malicious email in Zimbra Classic UI caused the browser to execute JavaScript in the context of the authenticated session.

The campaign, tracked under different names by different vendors — LAUNDRY BEAR (Dutch AIVD/MIVD), Void Blizzard (Microsoft), TA488 (Proofpoint), CL-STA-1114 (Palo Alto Networks Unit 42) — hit NATO governments, defense sectors, transportation, finance, and U.S. nuclear facilities. Unit 42 identified nine IP addresses and nine command-and-control domains with an average lifecycle of 35.4 days. Proofpoint detects no TA488 activity specifically from February 2026, but Unit 42 reports continued targeting of unpatched instances.

Key Takeaways

CVE-2025-66376 is a stored XSS in Zimbra Classic UI: CSS @import in HTML email bypasses the sanitizer via fragmented tag recombination, executing JavaScript payload the moment the message opens.
The ZimReaper/Ulej payload steals 90 days of email history, the Global Address List, browser-saved passwords, 2FA scratch codes, and creates an app password named "ZimbraWeb" for persistent IMAP/POP3/SMTP access.
The patch released by Zimbra on November 6, 2025 (versions 10.0.18 and 10.1.13) fixes the vulnerability but does not revoke already-compromised access: app passwords survive credential resets.
CISA added CVE-2025-66376 to the KEV catalog on March 18, 2026; the July 23, 2026 joint advisory is signed by fifteen agencies from fifteen countries.

How CSS Becomes a Weapon: The Tag-Splitting Mechanic

The vulnerability lies in how Zimbra Classic UI processes HTML emails containing CSS @import directives. The intermediate sanitizer strips @import directives as a security measure, but the parser recombines separated tag fragments that, once united, reconstruct an SVG element with an onload handler. Execution occurs in the user's authenticated session, with full access to CSRF tokens and internal Zimbra APIs.

The reconstructed payload — documented as ZimReaper by The Hacker News and Ulej in CISA advisory AA26-204A — executes a precise sequence: it harvests the CSRF token, extracts browser-autofilled passwords, invokes GetScratchCodesRequest to obtain 2FA recovery codes, creates an application-specific password named "ZimbraWeb" via CreateAppSpecificPasswordRequest, enables zimbraPrefImapEnabled for IMAP access, and finally exfiltrates a TGZ archive containing the last 90 days of email via DNS and HTTPS to the Flowerbed C2 framework infrastructure. All without the user interacting beyond viewing the message.

Proofpoint described the mechanism precisely: "The XSS exploit is embedded directly in the HTML body of the message and fires as soon as the victim opens or previews it in the vulnerable Zimbra webmail client. No further user interaction is required." This characteristic upends the defensive paradigm built on decades of security awareness: the user who doesn't click, doesn't download, doesn't open attachments is compromised anyway.

The App Password Problem: When the Patch Isn't Enough

Correctly applying versions 10.0.18 or 10.1.13 — and later — closes the injection flaw but leaves intact the persistence mechanisms installed during compromise. The "ZimbraWeb" app password functions as a standalone credential for mailbox access protocols, bypassing the web flow with 2FA. Seqrite, cited by The Hacker News, highlighted: "App-specific passwords survive password resets."

Theft of 2FA scratch codes compounds the problem. Unit 42 noted that an attacker in possession of such codes can authenticate even after a primary password reset. The joint advisory explicitly lists "Two-factor authentication tokens" among exfiltrated data. The combination of a persistent app password and compromised recovery codes turns every touched account into a system that remains vulnerable regardless of standard reactive measures.

Attribution and Infrastructure: The Convergence of Names

The infrastructural overlap between the different tracking names was verified by comparing published indicator-of-compromise lists. The Hacker News analyzed both indicator sets published by Unit 42 and Proofpoint: "compared the two indicator lists and found the same nine domains in both, which puts Unit 42's CL-STA-1114 and Proofpoint's TA488 on the same infrastructure." This convergence solidifies the view of a single operation under different analytic labels.

The July 23, 2026 joint advisory formally attributes the activity to the Russian state and details the victimology: NATO governments, defense entities, critical infrastructure, financial organizations, and U.S. nuclear facilities. Beth Hopkins, COO of the UK NCSC, stated: "This phishing campaign demonstrates how hostile actors will ruthlessly adapt techniques and exploit vulnerable technology in pursuit of their aims to steal sensitive information from Western organizations."

Unconfirmed remains the hypothesis of systematic use of AI language models in exploit development. Proofpoint judged the scenario "plausible" but clarified that no technical evidence supports it. The CISA advisory mentions that "AI played a role in development of simple codebase" without detailing the nature of that involvement.

What to Do Now

Organizations running Zimbra Collaboration Suite with Classic UI must act on multiple fronts simultaneously. The primary source and government advisories indicate the following priorities:

Verify version and apply patch: Zimbra released fixed versions on November 6, 2025; builds prior to 10.0.18 and 10.1.13 remain vulnerable. Per the NVD record for CVE-2025-66376, affected versions are ZCS 10.0 prior to 10.0.18 and 10.1 prior to 10.1.13.
Treat accounts that viewed suspicious emails as compromised: every account that opened or previewed messages during the campaign's active period must be considered compromised regardless of the absence of apparent user actions.
Revoke unauthorized app passwords and regenerate 2FA credentials: specifically search for app passwords named "ZimbraWeb" or similar, remove them, and regenerate 2FA scratch codes since the previous ones were exfiltrated.
Terminate active sessions and reset primary passwords: revoking existing sessions and changing passwords are necessary but insufficient without simultaneous deletion of app passwords created during compromise.

"Unlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR's latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service."
— Joint advisory NSA/CISA/FBI et al., cited by Dark Reading

Why This Changes Everything: The End of "Don't Click" as a Strategy

The ZimReaper campaign marks a turning point in the relationship between email architectures and threat models. When merely viewing a message turns the user's browser into an agent of passive compromise, the defensive perimeter shifts irrevocably from human behavior to software engineering. Security awareness training retains value but can no longer serve as a primary line of defense against this class of attacks.

Persistence obtained through app passwords and stolen 2FA codes introduces a dimension that incident response teams must integrate into playbooks: compromise is not a point event but a state that persists through legitimate service mechanisms. The distinction between a normal account and a compromised one becomes operational only through explicit checks for artifacts like app passwords, not through patching alone.

Uncertainty remains. The exact number of compromised organizations has not been made public by Unit 42 or other primary sources. The identity of individual operators remains unknown: the Denis Obrezko court case, mentioned by TechTimes, is not corroborated by other sources in the set. It is undocumented whether exfiltrated credentials were actually reused or held as operational reserve. Finally, the dossier does not specify whether versions after 10.1.13 — such as 10.1.20 from July 2026 — have reached all target organizations.

FAQ

Why does the CVSS show discordant scores?

MITRE assigns CVE-2025-66376 a CVSS 7.2 with vector UI:N (no user interaction), while the NVD record reports 6.1 with UI:R (requires interaction). Unit 42 classifies the exploit as zero-click. The discrepancy reflects different interpretations of the "interaction" requirement in the context of merely viewing an email.

Does the exploit work in Zimbra Modern UI as well?

The dossier explicitly identifies Classic UI as the vulnerable surface. No evidence emerges extending the same tag-splitting mechanic to Modern UI.

Why is the joint advisory from July 2026 if the patch is from November 2025?

The July 23, 2026 advisory formalizes state attribution and coordinates public disclosure among fifteen international agencies. The patch was already available but the campaign had been analyzed only in private circles; the government publication integrates vendor research with classified intelligence.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references