Zimbra phishing and NHI abuse expose mail platform blind spots

At a glance

What this is: This is SafeBreach’s analysis of a Russian state-supported Zimbra phishing campaign that turns a single email view into directory theft and mailbox exfiltration.

Why it matters: It matters because mail platforms, identity signals, and privileged access around email systems can all be abused when unpatched webmail, account reuse, and outbound controls are weak.

By the numbers:

• Since July 2025, the LAUNDRY BEAR campaign has targeted Zimbra Collaboration Suite environments across US and allied government and commercial networks.
• The exploit exfiltrates the organization’s email directory and the last 90 days of the victim’s communications.
• The actors use four SafeBreach simulations mapped to AA26-204A to validate detection and blocking of exfiltration behaviour and C2 reachability.

👉 Read SafeBreach’s analysis of CISA Advisory AA26-204A and Zimbra phishing exposure

Context

Zimbra phishing becomes an identity and governance problem when a vulnerable webmail session can be turned into a collection channel with no meaningful user friction. In this campaign, the primary control gap is not user awareness alone but unpatched webmail, weak outbound filtering, and insufficient monitoring of mailbox-level API activity and session abuse.

SafeBreach’s coverage is useful because it translates an advisory into controllable test cases for email security, egress controls, and detection engineering. For IAM and PAM teams, the intersection is clear: mail access, application passcodes, and compromised sessions all become part of the trust boundary once attackers can operate inside the collaboration stack.

Key questions

Q: What fails when a phishing email can execute on open in webmail?

A: The failure is a trust model that treats message rendering as harmless. When a vulnerable webmail client executes payloads on open, the attack bypasses link filtering and attachment inspection, so patching, content-rendering controls, and session monitoring become the real barriers. Teams should assume the inbox can be an execution surface, not just a delivery surface.

Q: Why do compromised executive mailboxes create broader identity risk?

A: Because they give attackers a trusted channel inside normal business workflows. Once a mailbox is compromised, the attacker can impersonate internal communication, request payments, reset credentials, or spread fraudulent links without needing obvious malware. That makes the mailbox itself a governed identity asset, not just a messaging endpoint.

Q: How do security teams know if exfiltration controls are actually working?

A: Look for evidence that bulk file access, compression, and outbound staging are detected early and correlated with privileged sessions. If teams only see the breach after a leak site post, the control failed. Effective monitoring should surface unusual data movement before attackers can weaponise it.

Q: Who is accountable when an exploited platform flaw exposes user mail or trusted access?

A: Accountability is shared across vulnerability management, platform ownership, and identity governance. Patch teams close the code issue, but the business owner must confirm exposure was limited and identity teams should validate whether delegated access, sign-ins, or privileged sessions were abused. For regulated environments, evidence of timely triage and access review matters as much as the patch itself.

Technical breakdown

How the view-based Zimbra exploit turns email open into execution

The campaign uses a view-based exploit in Zimbra Collaboration Suite, so the malicious payload runs when the recipient opens the message in a vulnerable webmail instance. That means the browser and mail client become part of the attack surface, not just the inbox. The exploit described in the advisory was originally a zero-day and is now tracked as CVE-2025-66376. Because execution is tied to message rendering, classic link-filtering and attachment controls do not fully address the risk.

Practical implication: Patch ZCS promptly and treat automatic content rendering as a security control dependency, not a convenience feature.

Why mailbox and directory exfiltration is easy after initial access

Once the payload runs, the actors use authenticated access to collect the email directory and the last 90 days of communications, then stage the data on actor-controlled infrastructure. This is a collection pattern built on session trust, API reach, and weak segregation between mail access and broader organization data. The advisory also describes use of application passcodes, IMAP enablement, and scratch-code theft in earlier activity, showing how mailbox persistence and credential abuse reinforce each other.

Practical implication: Limit mailbox privilege scope, monitor API use, and review whether email systems permit persistence patterns that outlast the original compromise.

How exfiltration moves through DNS and HTTPS to attacker infrastructure

The advisory maps exfiltration over both HTTPS and DNS, which lets actors move different data sizes through channels that often receive uneven scrutiny. Larger mail payloads travel over HTTPS, while smaller data elements can be Base32-encoded and sent via DNS queries, increasing the chance of blending into routine traffic. This dual-channel design is why mail security testing has to include egress inspection, not only inbound phishing detection.

Practical implication: Test DNS and HTTPS egress controls against mail-server exfiltration paths and alert on unusual directory or mailbox transfer patterns.

Threat narrative

Attacker objective: The objective is espionage through bulk collection of mailbox content, directory data, and related sensitive communications from targeted government and commercial networks.

1. Entry occurs when a phishing email carrying a malicious JavaScript payload is opened in an unpatched Zimbra webmail instance, causing code execution without a click or attachment open.
2. Credential access and persistence follow when the actors use valid accounts, application passcodes, and stolen scratch codes to maintain mailbox access after the initial exploit.
3. Impact occurs when the campaign exfiltrates the victim’s email directory and recent communications to attacker-controlled infrastructure over HTTPS and DNS.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• DeepSeek breach — DeepSeek breach exposed 1M+ log lines and sensitive secret keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Mail platforms are now identity infrastructure, not just communications tools. When a webmail session can be weaponised on message open, the boundary between collaboration security and identity governance disappears. That shifts the control question from simple user training to patch discipline, session trust, and mailbox privilege management. Practitioners should treat mail systems as high-value identity surfaces.

Standing trust in authenticated collaboration sessions creates a collection window that attackers can exploit immediately. This campaign succeeds because it can operate inside an already trusted session and then harvest mail, directories, and related context at speed. Session trust gap: the organisation assumes the session remains benign after authentication, but the exploit converts that session into a collection engine. Teams should reduce that trust window wherever possible.

Compromised mail access often becomes an NHI problem as soon as automation and API use enter the picture. Application passcodes, IMAP enablement, and scripted collection turn mailbox access into a non-human access pattern that ordinary user controls do not govern well. That is where IAM, PAM, and NHI oversight intersect. Practitioner conclusion: collaboration tooling needs the same lifecycle and privilege scrutiny as other privileged identity surfaces.

Outbound monitoring is part of identity defence when the compromised asset is a mailbox. If exfiltration can leave through HTTPS or DNS, inbound detection alone will miss the real objective. Controls that watch only login events miss the point when the attacker has already authenticated. Practitioners should align mail telemetry, egress policy, and identity monitoring into one response model.

This advisory validates control testing over assumption-based defence. SafeBreach’s simulation mapping shows that organisations need to prove whether they can detect and block the campaign’s behaviour, not merely claim patching coverage. The broader lesson is that advisory-driven validation should be routine for mail infrastructure and any identity-adjacent platform. Practitioners should use attack simulation to expose blind spots before an APT does.

From our research:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• From our research: 4.6% of all public GitHub repositories contain at least one hardcoded secret, according to The State of Secrets Sprawl 2025.
• For related guidance: Review Guide to the Secret Sprawl Challenge for practical controls that reduce exposed secrets and shorten attacker dwell time.

What this signals

Session trust is now an attack surface. For mail and collaboration platforms, the question is no longer whether users can be trained to avoid bad messages. The real programme signal is whether a compromised or vulnerable session can still reach directory data, recent communications, and external egress paths before controls intervene.

Identity teams should align mail platform governance with NHI oversight because application passcodes, API access, and automated collection are no longer edge cases. The control objective is to shrink the time between compromise and containment, especially where privileged collaboration workflows can be replayed or extended.

If your programme already watches for exposed secrets, the same logic should apply to mail access paths and session abuse. The attacker’s advantage is speed, so detection has to focus on abnormal collection, unusual outbound channels, and weak lifecycle controls around authentication materials.

For practitioners

• Patch Zimbra webmail instances without delay Apply the vendor fix for CVE-2025-66376 and verify that all webmail front ends are on a patched build, including secondary or less visible deployments.
• Restrict mailbox persistence mechanisms Review whether IMAP, application passcodes, and scratch-code workflows are enabled where they are not operationally required, because those paths extend attacker dwell time.
• Monitor mail API and directory abuse Alert on bursts of SearchGalRequest activity, unusual mailbox.log patterns, and mass directory or recent-mail access that does not fit normal user behaviour.
• Test egress controls against DNS and HTTPS exfiltration Simulate outbound requests from mail infrastructure to identify whether DNS queries and HTTPS uploads can carry staged mailbox data to external hosts.
• Use attack simulation to validate advisory reachability Run simulations that mirror the advisory’s C2 and exfiltration patterns so teams can confirm detection, blocking, and triage workflows before a real campaign lands.

Key takeaways

• This campaign shows that a single vulnerable webmail view can become an execution and collection event, which makes mail security an identity governance issue as much as a patching issue.
• The impact is not limited to message theft. The advisory describes directory exfiltration, 90 days of communications, and alternate egress paths that can evade weak monitoring.
• The control that matters most is not one safeguard but the combination of patching, mailbox privilege review, and outbound detection that closes the attacker’s collection window.

Key terms

• View-Based Exploit: A view-based exploit triggers when a user merely renders or opens content, rather than clicking a link or downloading a file. In mail systems, this shifts the attack surface into the client and webmail renderer, so message display itself becomes a potential execution path.
• Mailbox Persistence Risk: The chance that an attacker keeps access through email configuration rather than malware or a stolen password. Forwarding rules, hidden filters, delegated access, and linked applications can preserve visibility after the original exploit is patched, making remediation incomplete if mailbox settings are not reviewed.
• Egress Exfiltration: Egress exfiltration is the removal of data through outbound channels such as HTTPS or DNS rather than through obvious file transfer tools. It is effective when organisations inspect inbound threats but give too little scrutiny to what leaves trusted infrastructure.
• Application Passcode: An application passcode is an alternate authentication material that allows access to an account or protocol without the normal interactive login flow. When attackers obtain or generate these values, they can bypass some MFA protections and keep using a mailbox or application as if they were the legitimate user.

What's in the full article

SafeBreach's full post covers the operational detail this post intentionally leaves for the source:

• IOC mappings and simulation identifiers for the AA26-204A campaign, including the exact attack content SafeBreach added.
• Step-by-step guidance for running the relevant SafeBreach Scenarios, Attack Playbook entries, and Known Attack Series report items.
• The specific egress and detection checks used to validate DNS and HTTPS exfiltration behaviour against advisory-listed infrastructure.
• Mitigation workflow details for ZCS, including how the vendor fix and configuration review are applied in practice.

👉 SafeBreach’s full post includes the advisory mappings, IOC-based simulations, and mitigation guidance for ZCS environments.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, IAM, and secrets management. It is designed for practitioners who need a practical framework for reducing identity-driven attack paths across modern environments.