Russian Hackers Exploited Zimbra Zero-Day to Steal Emails and 2FA Codes

A Russian state-sponsored group exploited a zero-day vulnerability in Zimbra's webmail client to access Western mailboxes. The attack stole the last 90 days of emails, the full directory, saved passwords, and two-factor recovery codes. Opening the malicious message was enough to trigger the exploit, according to the NSA and CISA.