SideWinder Targets Government Webmail With Bogus Chrome PDF Viewer and Zimbra Phishing Clone

SideWinder, an advanced persistent threat group, is running a targeted credential-harvesting phishing campaign against government and military targets in South Asia (notably the Bangladesh Navy and Pakistan’s Ministry of Foreign Affairs). The attackers use a Cloudflare Workers–hosted, pixel-perfect Zimbra webmail clone that dynamically proxies authentic assets and employs session/CSRF tricks and staged redirects to capture credentials; researchers discovered the campaign after a developer error exposed an application stack trace revealing internal identifiers useful for defender tracking.