A malicious email can steal Zimbra data just by being viewed

A malicious email can expose data from a vulnerable Zimbra webmail account without the recipient clicking anything. A joint international advisory says the Russian state-supported group commonly called LAUNDRY BEAR is using the view-based attack against government and commercial organizations.

Viewing the message in a vulnerable version of Zimbra Collaboration Suite can trigger the attempt. The agencies say it can seek the previous 90 days of email, the organization directory and other sensitive information. The advisory describes targeting of government and commercial organizations; it does not establish that every Zimbra deployment was reached.

CVE-2025-66376 was patched in November 2025. Organizations should confirm the deployed version, update vulnerable or unsupported systems and use the advisory’s indicators to investigate possible exposure. If indicators of compromise are found, follow the advisory’s remediation: revoke all Application Passcodes and 2FA scratch keys, and require employees to change passwords. Awareness training cannot stop a flaw that activates when an email is simply viewed.

Patching closes the flaw; investigation answers the exposure question

Updating a vulnerable server prevents the same route from remaining open, but it cannot establish whether the flaw was used before the fix. That answer comes from the indicators and local evidence described in the advisory. Mail-server access, account activity and session records deserve review in the context of the organization’s retention and logging. A confirmed compromise also changes the work from ordinary patching to incident response. The advisory supports both actions without pretending that every vulnerable deployment was breached.