“Half-Click” Zimbra Email Attack Steals 90 Days

How the attack worked

According to CISA, this campaign can compromise certain unpatched Zimbra email accounts simply when a user opens or previews a malicious message in webmail. Attackers embed malicious JavaScript inside a specially crafted HTML email, which runs automatically when the webmail client renders the message. Because no link click is technically required, Proofpoint describes it as a "half-click" attack: the victim only needs to open the email or let it appear in a preview pane.

Once triggered, the code can collect passwords, authentication data, and as much as 90 days of stored messages. It can also copy the Global Address List, giving attackers material for further impersonation attempts against colleagues and partners. In some cases, the attack creates a new Zimbra application passcode and sends it back to the attacker, which can preserve access even after the victim changes their password.

Why it succeeded

The attack targets unpatched Zimbra systems, meaning the technical exploit does the initial work rather than tricking a user into an obvious mistake. This is compounded by a second track: adversary-in-the-middle phishing kits that present login pages closely resembling legitimate email portals, hosted on lookalike domains such as mailnalysis.com and zimbrastat.com. Lures observed by Proofpoint included messages sent from attacker-controlled Proton Mail accounts, with pretexts like a partnership proposal from a media-verification organization around EU disinformation cooperation, an approach designed to look like routine, legitimate outreach rather than an obvious phishing attempt.

What to watch for

• Unexpected partnership or cooperation emails from unfamiliar senders, especially those using external mail infrastructure
• Login prompts or webmail pages reached via an email link rather than a known, bookmarked address
• Domain names that closely resemble Zimbra but are slightly altered
• Unexpected application passcodes, particularly ones labeled "ZimbraWeb"
• Emails that seem harmless in content but rely on rendering HTML in a preview pane

How to build resistance

Organizations should reinforce that clicking isn't the only risk, simply previewing an email on an unpatched system can be enough for compromise, so suspicious messages should be reported rather than just left unclicked. Staff should be trained to navigate directly to their organization's known webmail address instead of following email links, and to treat unexpected re-authentication prompts with suspicion. IT and admin teams should routinely check for unusual application passcodes and mailbox forwarding rules as persistence indicators. Finally, keeping webmail platforms patched remains essential: strong passwords and trained employees cannot fully protect against an exposed, unpatched email server.

What is a half-click email attack?

It's an attack where malicious JavaScript embedded in a specially crafted HTML email runs simply when a user opens or previews the message in webmail, without requiring any link click.

What data can this Zimbra attack steal?

The malicious code can collect passwords, authentication data, and as much as 90 days of messages, plus copy the Global Address List for follow-on impersonation.

How does the attacker maintain access after a password change?

The attack may create a new Zimbra application passcode, which can preserve attacker access even after the victim changes their password. CISA urged admins to watch for suspicious passcodes labeled ZimbraWeb.

Are there other tactics used besides the email exploit?

Yes, the same campaign also uses adversary-in-the-middle phishing kits with fake login pages and Zimbra lookalike domains to capture credentials and session cookies.