Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
Summary: A Russian state-supported espionage group read Western mailboxes for months through CVE-2025-66376, a stored cross-site scripting flaw in Zimbra's Classic UI that runs when a crafted HTML email renders. The payload, tracked by Proofpoint as ZimReaper, takes the last 90 days of email, the Global Address List, the browser's saved password and 2FA scratch codes, and exfiltrates them over DNS; Zimbra fixed the flaw on November 6, 2025, and CISA added it to the KEV catalog on March 18, 2026.
Why it matters: The payload mints an app-specific password named ZimbraWeb that grants IMAP, POP3 or SMTP access without two-factor authentication, and app-specific passwords survive password resets - so patching closes the hole but leaves the credentials already taken.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-66376
- Related
- CVE-2025-66376: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Known Exploited Vulnerabilities · Mar 18, 2026