Russian Hackers Used a Zimbra Zero-Day to Steal Emails Without Link Clicks

Proofpoint and US government partners attribute a campaign to Russia-linked TA488 that exploited a Zimbra zero-day (CVE-2025-66376) allowing malicious JavaScript in an email's HTML body to run on preview; the attacker-deployed ZimReaper harvested email addresses, browser-saved passwords, 2FA scratch codes, exported up to 90 days of mail, created persistent "ZimbraWeb" application passwords, and exfiltrated data via DNS and web traffic. Zimbra released patches in November 2025 (ZCS 10.1.13 and 10.0.18) and the advisory urges administrators to update servers, revoke application passwords and 2FA scratch codes, reset passwords, and review audit logs for signs of compromise.