A Russian state-supported espionage group exploited a previously unknown zero-day flaw in Zimbra’s webmail client to steal emails and two-factor authentication codes. The attack, which only required opening or previewing a malicious message, targeted Western mailboxes for months. The payload was designed to exfiltrate the last 90 days of email, the entire email directory, browser-saved passwords, and 2FA recovery codes, as detailed by the NSA, CISA, and partner agencies.