TL;DR: A view-based Zimbra exploit in CISA Advisory AA26-204A shows how LAUNDRY BEAR triggered on email open, exfiltrated directory data and 90 days of mail, and bypassed normal user interaction, according to SafeBreach. Mail security assumptions fail when access and content rendering become the attack surface, not just credentials.
At a glance
What this is: SafeBreach maps a Russian state-supported Zimbra phishing campaign to a view-based exploit that fires when users open malicious mail and can exfiltrate directory data and recent communications.
Why it matters: IAM, PAM, and mail security teams need to treat webmail rendering, session abuse, and mailbox access as governance issues, not just phishing problems, because the attack path bypasses normal click-based defenses.
Context
Zimbra webmail can become an execution and collection surface when message rendering is allowed to drive code paths before the user has meaningfully interacted with the content. In this campaign, the risk is not just stolen credentials but trusted access to mailboxes, directories, and authenticated sessions that were already in use.
For identity and access programmes, this is a reminder that mail systems often sit at the boundary between human identity, session state, and application trust. When automatic content processing and long-lived mailbox privileges are not tightly governed, phishing can turn into broad collection and exfiltration even without traditional credential theft.
Key questions
Q: What breaks when unpatched webmail can execute content on message open?
A: The mail client stops being a passive viewer and becomes an execution surface, which means a phishing email can trigger code before a user clicks anything. That defeats assumptions built around click-based awareness training and pushes defenders toward patching, render-path restrictions, and stronger isolation of webmail sessions.
Q: Why does authenticated mailbox session abuse increase the impact of phishing?
A: Because the attacker does not need to become a new user if the victim’s existing session already carries the right authority. Once the browser session is trusted, the payload can issue mailbox and directory requests at scale, turning one open message into broad collection and exfiltration.
Q: What are the signs that mailbox authentication is being extended after compromise?
A: Look for unexpected application passcode creation, IMAP enablement, scratch code use, and mailbox log patterns that show bulk directory queries or scripted access. Those signals suggest the attacker is trying to keep mailbox access alive after the initial phishing event and MFA bypass.
Q: How should organisations respond when phishing targets a mail platform rather than a user login?
A: They should treat the mail platform as part of the identity system, not just the delivery system. That means prioritising patching, session monitoring, mailbox privilege review, and egress blocking so that active sessions and rendered content cannot be used to move data out of the environment.
Technical breakdown
View-based exploitation in Zimbra webmail
The campaign relies on a view-based exploit in Zimbra Collaboration Suite webmail, where simply opening a malicious email can trigger JavaScript execution in a vulnerable, unpatched instance. That matters because the browser becomes part of the attack surface, and the mail client no longer acts as a passive display layer. The article ties the weakness to CVE-2025-66376, which had been a zero-day when the campaign began. The security problem is not only phishing delivery but message rendering that permits code execution before user intent is fully established.
Practical implication: Treat automatic rendering in webmail as an attack surface and verify that the relevant vulnerability is patched everywhere.
Mailbox collection through authenticated session abuse
Once the payload runs, it uses the victim’s authenticated browser session to access ZCS data through API and SOAP requests. The article says the actors collect the email directory and the previous 90 days of communications, which shows how a browser session can become an authorization bearer for large-scale data collection. This is an identity governance issue as much as a mail issue, because the exploit depends on existing session trust rather than repeated authentication prompts. In practice, session scope becomes the control boundary.
Practical implication: Constrain mailbox session scope and monitor authenticated requests that look like bulk directory or mailbox harvesting.
Persistence and multi-factor bypass through mailbox controls
The advisory describes account manipulation, IMAP enablement, application passcodes, and stolen scratch codes as persistence mechanisms. Those actions show how mailbox-level controls can be repurposed to preserve access after the initial phishing event. The campaign also uses valid accounts and prior compromises, so the identity layer is part of the persistence path rather than a separate concern. The broader lesson is that mailbox privileges, MFA recovery material, and application-specific authenticator pathways all need lifecycle governance.
Practical implication: Review mailbox authentication pathways, including application passcodes and recovery codes, as part of identity governance rather than helpdesk operations.
Threat narrative
Attacker objective: The objective is espionage through bulk collection of email and organisational data from targeted government and commercial environments.
- Entry occurs when the actor sends a malicious email that exploits Zimbra webmail as soon as the recipient opens the message in an unpatched instance.
- Credential and session abuse follow when the payload rides the victim’s authenticated browser session and uses application passcodes or scratch codes to extend access.
- Collection and exfiltration occur when the actors harvest mail directories, recent communications, and related data, then send it to actor-controlled infrastructure over HTTPS and DNS.
Breaches seen in the wild
- EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Automatic message rendering is now a governance control point, not a convenience feature. This campaign shows that a mail client can turn display logic into execution logic when unpatched webmail processes content before the user has meaningfully acted. That shifts the control conversation from spam filtering to render-path hardening, patch latency, and authenticated-session protection. Practitioners should treat message rendering paths as part of the identity and application trust boundary.
Mailbox session state is the real privilege boundary in this campaign. Once the actor uses the victim’s authenticated browser session, the question is no longer whether the message was suspicious but whether the session can be abused to collect mail at scale. This is where identity governance meets operational mail security: access scope, session duration, and application-specific authenticator controls all determine blast radius. Teams should audit the trust attached to active mailbox sessions.
Mail privilege persistence is the failure mode this campaign exposes. Account manipulation, IMAP enablement, application passcodes, and stolen scratch codes show that mailbox access can survive beyond the first compromise if recovery and application authentication pathways are weakly governed. That is a lifecycle problem, not a point-in-time phishing problem. Practitioners should review how mail-specific privileges are created, extended, and revoked across the full identity lifecycle.
ATT&CK-mapped mail exploitation is converging with identity abuse. LAUNDRY BEAR’s use of valid accounts, session hijacking, and exfiltration over alternative protocols shows that the campaign is not a single vulnerability story. It is a chain that joins delivery, execution, identity reuse, and collection. For defenders, the implication is to align mail hardening with identity telemetry so that abuse of trusted access becomes detectable before data leaves the environment.
From our research library:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
What this signals
Mail platforms now sit at the junction of identity, session trust, and content execution. The practical response is to govern webmail like a privileged application: patch aggressively, reduce automatic rendering, and watch authenticated sessions for bulk access patterns that do not match normal human use.
Mail privilege persistence deserves the same scrutiny as service account persistence. Application passcodes, recovery codes, and IMAP access can keep a mailbox usable after the initial event, so teams should fold mailbox-specific authentication paths into their lifecycle review.
Browser-session abuse changes the detection problem. Security teams need telemetry that ties mail access to session behaviour and egress destinations, because the exfiltration step may look like ordinary authenticated traffic until it is too late.
For practitioners
- Patch vulnerable Zimbra webmail instances Remediate CVE-2025-66376 everywhere and verify that unpatched webmail instances are not exposed to external users.
- Restrict automatic content rendering Reduce the chance that opening a message can trigger execution by reviewing webmail settings that auto-render active content.
- Harden mailbox authentication pathways Review application passcodes, scratch codes, and IMAP enablement so mailbox access cannot be extended quietly after compromise.
- Monitor for bulk mailbox and directory access Alert on SearchGalRequest bursts, unusual access to the last 90 days of mail, and outbound transfers from mail infrastructure to unfamiliar hosts.
- Validate egress controls against mail exfiltration Block and test outbound HTTPS and DNS channels from mail servers so harvested data cannot reach actor-controlled infrastructure.
Key takeaways
- This campaign shows that unpatched webmail can become an execution and collection path, not just a phishing target.
- The attacker objective is bulk espionage, using mailbox trust and authenticated sessions to harvest directories and recent communications.
- Patch management, render-path restrictions, mailbox session monitoring, and egress control are the controls most likely to limit the blast radius.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The campaign abuses mail authentication and session trust to extend access after initial compromise. |
| NHI-07 — Long-Lived Secrets | Application passcodes and scratch codes can preserve mailbox access beyond the initial incident. | |
| NHI-10 — Human Use of NHI | Human-operated mailbox controls such as application passcodes are being repurposed in the attack chain. | |
| Recommendation — Review mailbox authentication paths to prevent session and recovery-code abuse after phishing. Shorten the lifespan of mailbox recovery material and remove stale application passcodes. Separate human helpdesk workflows from mailbox control paths that attackers can weaponise. | ||
| MITRE ATT&CK | TA0006;TA0008;TA0010 — Credential Access; Lateral Movement; Exfiltration | The campaign combines session abuse, collection, and exfiltration across several ATT&CK tactics. |
| Recommendation — Map mailbox abuse telemetry to credential access, lateral movement, and exfiltration hunting patterns. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Mailbox and application access scope determines how far the actor can move once inside. |
| Recommendation — Constrain mailbox entitlements so authenticated sessions cannot harvest data at scale. | ||
| CIS Controls v8 | CIS-5 — Account Management | Mailbox account manipulation, passcodes, and IMAP enablement are account-management failures. |
| Recommendation — Audit and revoke mailbox account changes that create persistent post-compromise access. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | The exploit uses authenticated browser state and mailbox APIs to collect data after initial delivery. |
| Recommendation — Harden API and session authentication so mailbox requests cannot be replayed as a trusted user. | ||
Key terms
- View-Based Exploit: A view-based exploit triggers when a user merely renders or opens content, rather than clicking a link or downloading a file. In mail systems, this shifts the attack surface into the client and webmail renderer, so message display itself becomes a potential execution path.
- Application Passcode: An application passcode is an alternate authentication material that allows access to an account or protocol without the normal interactive login flow. When attackers obtain or generate these values, they can bypass some MFA protections and keep using a mailbox or application as if they were the legitimate user.
- Browser Session Theft: Browser session theft is the capture of authenticated web-session state after a user has already signed in. It is dangerous because the attacker may not need to know the password or defeat MFA again, only reuse the live session to act as the victim.
- Mailbox Rule Persistence: Mailbox rule persistence occurs when an attacker creates forwarding, deletion, or filtering rules that keep control of a compromised inbox after the initial login. These rules can hide evidence, redirect messages, and preserve access even when the password is changed.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management. It helps practitioners connect identity controls to the access paths attackers abuse in real environments.
Published by the NHIMG editorial team on August 1, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org