Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A Russian state-linked espionage group exploited a stored XSS in Zimbra Classic Web Client (CVE-2025-66376) using a view-only, tag-splitting HTML email that executed a JavaScript payload (ZimReaper) to steal CSRF tokens, autofilled passwords, 2FA scratch codes, enumerate the Global Address List, and exfiltrate 90 days of mail; vendors and US agencies released advisories, mitigations, and IoCs while recommending patching, credential resets, session invalidation, and account reviews.