Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail client. The payload goes after the last 90 days of email, the organization's entire email directory, the password saved in the browser and the codes kept for two-factor recovery. Opening the message was enough to start it. The NSA, CISA and partner agencies published

The article describes a Russian state-supported espionage group exploiting a zero-day stored XSS flaw (CVE-2025-66376) in Zimbra’s Classic Webmail UI to silently execute JavaScript when a crafted email is merely opened or previewed.[1][7][9] This payload exfiltrates the last 90 days of email, the organization’s email directory, browser-saved passwords, and two-factor authentication scratch/recovery codes, enabling sustained unauthorized access even after password resets.[1][2][7][9] From a RealGround perspective, this is primarily a data leakage risk: any AI agents or LLM workflows integrated with Zimbra or fed email data could inadvertently expose highly sensitive communications and credentials to a compromised mail environment, and compromised 2FA codes materially weaken identity controls protecting downstream AI systems. Practically, organizations should pair aggressive patching and account remediation with continuous AI red teaming focused on how email-sourced data and credentials flow into AI agents, testing for scenarios where an attacker controlling mailboxes can pivot into AI systems, poison inputs, or misuse exfiltrated secrets.