The phishing email does not need a link. It does not need an attachment. On a vulnerable webmail server, displaying the message is the exploit.

Proofpoint calls this a half-click attack: malicious HTML executes when the target opens or previews an email. In July 2026, Proofpoint published two investigations into Russian-aligned espionage actors using this technique across Zimbra, SOGo, Roundcube, MDaemon, and Kerio. A multinational government advisory released through the NSA separately confirmed the Zimbra campaign.

TL;DR

  • TA488 exploited Zimbra CVE-2025-66376 as a zero-day during 2025; the flaw was fixed in Zimbra 10.1.13 and 10.0.18 in November 2025.
  • The malicious message ran JavaScript inside the authenticated Zimbra session as soon as it was viewed.
  • Proofpoint observed theft of credentials, two-factor recovery codes, contacts, and recent email, followed by creation of an app-specific password for persistence.
  • A separate actor, TA458, used the same general class of webmail XSS against several products, including SOGo CVE-2026-8496 in March 2026.
  • Patching closes the vulnerable renderer. It does not revoke credentials or persistence already created through a successful compromise.

Two Campaigns, One Trust Boundary

Proofpoint tracks the Zimbra actor as TA488, also known as Void Blizzard or Laundry Bear. Proofpoint describes it as Russia-aligned and likely directed by Russian intelligence. The NSA-led advisory uses the stronger, government-attributed description “Russian state-supported” for Laundry Bear.

Since at least July 2025, the actor sent exploit-bearing messages to Ukrainian entities and to government, scientific, and defense-sector targets in the United States. The NSA advisory says vulnerable, unpatched Zimbra installations were still being successfully exploited when the advisory was published on July 23, 2026.

Proofpoint’s second report covers TA458, an espionage actor it assesses as likely aligned with Russia’s military intelligence service, the GRU. Proofpoint observed TA458 exploiting Zimbra, MDaemon, Roundcube, Kerio, and SOGo webmail. Some were zero-days when used; others were already known vulnerabilities.

These assessments should not be flattened into certainty. The NSA directly attributes the Zimbra Laundry Bear campaign to a Russian state-supported actor. The TA458-to-GRU relationship remains Proofpoint’s assessment.

How One Message Became Code

CVE-2025-66376 was a stored cross-site scripting vulnerability in Zimbra’s Classic UI. Zimbra’s own release notes say an attacker could abuse CSS @import directives in email HTML. Proofpoint’s technical analysis shows how TA488 split executable HTML tokens with fake CSS directives and comments so the sanitizer failed to recognize them, while the browser reconstructed valid markup.

The result was JavaScript executing in the origin and authenticated context of Zimbra Webmail. That distinction matters. The payload did not need to compromise the browser or escape its sandbox. It inherited what the logged-in user could already reach through the webmail application.

Proofpoint named the resulting JavaScript malware ZimReaper. According to its analysis, ZimReaper could:

  • collect the user’s Zimbra CSRF token and browser-autofilled password
  • gather two-factor authentication scratch codes
  • enumerate the Global Address List
  • export and exfiltrate up to the previous 90 days of accessible email
  • create an app-specific password named ZimbraWeb
  • exfiltrate selected data through DNS and email archives through HTTP

The app-specific password is the part patch-only response plans miss. It could provide IMAP, POP3, or SMTP access without repeating the browser exploit. Proofpoint states that it did not establish whether TA488 actually used those generated credentials later, so they should be treated as a persistence opportunity rather than claimed as confirmed follow-on access.

Why Endpoint Detection Can Miss It

Much of the activity happens inside the browser’s JavaScript engine and through legitimate Zimbra APIs. There may be no dropped executable, suspicious child process, or conventional malware file for an endpoint product to quarantine.

That shifts detection toward the application and network layers:

  • newly created app-specific passwords, especially unexpected names such as ZimbraWeb
  • unusual bulk export or search activity against mailboxes
  • access through IMAP, POP3, or SMTP that does not match the user’s normal client
  • DNS queries carrying long, high-entropy labels from webmail clients or infrastructure
  • new sessions, forwarding behavior, or sent messages from previously trusted accounts
  • exploit-bearing message hashes and domains published in the Proofpoint reports

Indicators from a public report expire. Behaviors such as unexpected app-password creation and bulk mailbox export age much better.

Patch, Then Investigate

For CVE-2025-66376, Zimbra lists the fixes in versions 10.1.13 and 10.0.18, released November 6, 2025. Organizations on older or unsupported branches should follow Zimbra’s supported upgrade guidance rather than assuming that a numerically similar package contains the fix. The later 10.1.14 release also resolved an IMAP regression introduced around the 10.1.13 update.

For SOGo, the vendor says version 5.12.8, or the May 8, 2026 nightly build identified in its release notes, fixed four security issues including two malicious-email XSS paths. Proofpoint maps one of those paths to CVE-2026-8496. SOGo 5.12.9 subsequently fixed regressions in 5.12.8.

If a vulnerable server was reachable while exploitation was occurring, use an incident-response sequence rather than closing a patch ticket:

  1. Preserve relevant webmail, authentication, proxy, DNS, IMAP, POP3, and SMTP logs.
  2. Update to a vendor-confirmed fixed and supported version.
  3. Find and revoke unexpected app-specific passwords and active sessions.
  4. Reset affected credentials and review two-factor recovery material.
  5. Hunt for mailbox exports, contact enumeration, abnormal protocol access, and messages sent from compromised accounts.
  6. Inspect downstream recipients: a trusted compromised mailbox can become the delivery system for the next exploit message.

The user did not fail a phishing test here. The webmail renderer failed to keep untrusted email data from becoming trusted application code. Training cannot repair that boundary.

Sources