Russian Hackers Exploit Zimbra Zero-Click XSS to Steal Email & MFA Tokens
A zero-click cross-site scripting vulnerability in Zimbra Collaboration Suite (CVE-2025-66376) is being actively exploited by Russian state-sponsored actors to silently harvest emails, credentials, and MFA tokens without any user interaction. Because the flaw is triggered simply by receiving a crafted HTML email, traditional security awareness training provides no defense — the attack succeeds before a user can make a decision. The exfiltration of MFA tokens is particularly dangerous as it effectively nullifies a critical layer of authentication protection. This incident underscores that unpatched, internet-facing collaboration platforms represent a high-value, low-friction target for nation-state adversaries seeking persistent access to sensitive communications.
Tactical Insight
Immediate actions
- Apply the vendor patch for CVE-2025-66376 immediately, or isolate Zimbra instances from the internet until patching is complete.
- Audit Zimbra server logs for anomalous outbound DNS and HTTPS traffic patterns indicative of the 'Flowerbed' exfiltration framework.
- Rotate all credentials and MFA tokens for accounts hosted on potentially exposed Zimbra instances.
Long-term improvements
- Implement a formal emergency patching SLA (e.g., ≤24 hours) for critical, internet-facing systems when a zero-day or actively exploited CVE is disclosed.
- Maintain a continuously updated inventory of all internet-facing collaboration and mail platforms to ensure no asset is missed during rapid patch cycles.
- Replace SMS/TOTP-based MFA with phishing-resistant FIDO2/hardware keys to limit the value of stolen MFA tokens.
Detection measures
- Deploy network-layer inspection and DNS monitoring to detect and alert on data exfiltration attempts over DNS tunneling or unusual HTTPS egress from mail servers.
- Enable SIEM correlation rules that flag JavaScript execution anomalies or unexpected API calls originating from Zimbra processes.
- Subscribe to threat intelligence feeds covering nation-state TTPs (e.g., Void Blizzard/Laundry Bear) to receive early warning of new tooling or infrastructure indicators.