> TritonInfoSec News
Home / Jul 25, 2026 / Story
0
#1 The Hacker News general July 23, 2026 at 18:36 UTC

Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

By [email protected] (The Hacker News)

AI Summary

Russian state-sponsored group 'Laundry Bear' exploited a Zimbra zero-day for five months before a July 2025 patch, using a zero-click 'half-click' phishing technique requiring only that a victim open or preview a message. The payload exfiltrates the last 90 days of email, the full organizational email directory, browser-saved passwords, and 2FA recovery codes. NSA, CISA, and partner agencies issued a joint advisory, making this a critical defensive priority for any organization running Zimbra webmail.

Read full article → https://thehackernews.com/2026/07/russian-espionag…

Relevance score: 88.0/100

# More from July 25

  1. 2
    Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller The Hacker News
  2. 3
    Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers The Hacker News
  3. 4
    Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say The Hacker News
  4. 5
    Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry The Hacker News
  5. 6
    Clop ransomware targets Windchill, FlexPLM in data theft attacks BleepingComputer
  6. 7
    Check Point warns of SmartConsole zero-day exploited in attacks BleepingComputer
  7. 8
    Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files The Hacker News
  8. 9
    New RefluXFS Linux flaw lets attackers gain root privileges BleepingComputer
  9. 10
    ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link The Hacker News