Hackers exploit Roundcube webmail flaw to steal email, credentials

Threat actors exploited a stored XSS in Roundcube (CVE-2024-37383) to deliver hidden, base64-encoded JavaScript inside emails that injects a fake login form to harvest Roundcube credentials and exfiltrate messages (via ManageSieve) to a remote host (libcdn.org); attacks targeted CIS government organizations and affect Roundcube versions prior to 1.5.7 and 1.6.7, with vendor patches available.