Russian Spy Group Exploits Zimbra Zero-Day to Steal Mail, Passwords and 2FA Codes
A Russian state-backed espionage group exploited a stored cross-site scripting flaw in Zimbra's Classic UI (CVE-2025-66376) to automatically render a malicious email in an authenticated webmail session, stealing CSRF tokens, browser-saved passwords, and 2FA scratch codes, and exfiltrating 90 days of mail; patching the vulnerability is necessary but does not revoke credentials, so organizations should patch, reset passwords, invalidate sessions, review for the ZimbraWeb app-specific password, and monitor for identified indicators of compromise.