Zero-Click Emails Hit Zimbra Users in Espionage Push

How the attack worked

This campaign relies on a hidden JavaScript payload embedded inside routine-looking emails. Rather than asking a victim to click a link or open an attachment, the payload is executed immediately when the emails are opened in Zimbra webmail. That means the simple act of reading a message in the web interface is enough to trigger compromise.

What makes the pretext especially convincing is that the emails come from previously compromised email accounts. Victims are not looking at a spoofed sender or an unfamiliar name, they are seeing a message that appears to come from someone they already know and trust.

Why it succeeded

Traditional phishing awareness training teaches people to scrutinize links and attachments before acting. This attack sidesteps that entire mental model. There is no suspicious link to hover over and no attachment to think twice about, just an email that looks routine and a webmail client that renders the hidden script automatically.

The use of real, previously compromised accounts as the delivery mechanism also removes one of the most reliable red flags defenders rely on, an unfamiliar or spoofed sender address.

What to watch for

• Unexpected emails, even from contacts you recognize, since their accounts may have been compromised and used to reach you
• Any unusual behavior after opening an email in Zimbra webmail, including unexpected session prompts, redirects, or signs of mailbox access you did not initiate
• Unexplained changes to mail forwarding rules or authentication settings
• Reliance on the Zimbra web interface specifically, since that is the platform this campaign targets

Post-compromise, the objective is broad: attackers have attempted to pull the last 90 days of emails, stored passwords, contact lists, and two-factor authentication tokens and other passcodes, so any sign of unusual mailbox activity deserves quick attention.

Building resistance

Because this attack does not depend on a user clicking anything, the most effective defenses are technical and procedural rather than purely behavioral:

• Patch Zimbra webmail software immediately wherever it is deployed
• Where patching is not immediately feasible, move affected users to a different mail client until it can be applied
• Reinforce with staff that opening an email is not automatically "safe," even without clicking further
• Extend awareness training to cover account compromise scenarios, since a message from a known contact is no longer a reliable trust signal on its own
• Monitor for anomalous mailbox access, unexpected authentication prompts, or unusual token or passcode requests tied to webmail sessions

Government, defense, transportation, and finance organizations are among those named as targets, reflecting the broad reach of this campaign across sectors that rely heavily on email-based communication and collaboration tools.

What makes this Zimbra phishing attack zero-click?

The malicious JavaScript payload is hidden inside the email itself and executes immediately when the message is opened in Zimbra webmail, so no link click or attachment download is required.

What data are attackers trying to steal?

According to the advisory, the campaign attempts to exfiltrate the last 90 days of emails, passwords, contact lists, and two-factor authentication tokens and other passcodes.

How are the phishing emails delivered?

The payload is hidden in emails sent from previously compromised email accounts, making the messages appear to come from real, trusted contacts.

What should Zimbra users do to protect themselves?

Government agencies urged organizations to immediately patch Zimbra software and, if patching is not feasible, to direct employees to use a different mail client until they can.