Hackers exploited Zimbra flaw as zero-day using iCalendar files

Researchers observed a zero‑day XSS in Zimbra Collaboration Suite (CVE-2025-27915) abused via large .ICS calendar attachments containing obfuscated JavaScript that steals credentials, emails, contacts, and exfiltrates data; the attacks began in early January against at least one Brazilian military target and StrikeReady published IOCs and a deobfuscated payload after Zimbra released patches on January 27.