# Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite

Zimbra webmail failed to sanitize CSS @import in email, letting a viewed email run JavaScript that exfiltrated 90 days of mail, GAL, 2FA codes and passwords.

- Payout: Real-world hack
- Severity: high
- Program: Zimbra Collaboration Suite
- Analysis by: CISA
- Disclosed: 2026-07-21
- CVE: CVE-2025-66376
- Write-up quality: 8/10
- Original: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a
- Library page: https://bugbountylibrary.com/r/blog%3Acisa-gov-news-events-cybersecurity-advisories-aa26-204a
- Tags: area:web domain:web impact:ato impact:data-leak impact:internal-access impact:pii-leak kind:incident platform:threat-intel sev:high tech:email technique:chained vuln:xss

**Target:** ZCS webmail (Classic/Standard/Modern clients) email rendering
**Root cause:** Improper neutralization of CSS @import directives in email content allows a JavaScript payload embedded in an SVG onload to execute when the email is merely viewed.
**Steps:**
1. Send email containing multiple `@import` directives plus an SVG element whose `onload` holds a Base64 payload.
2. Payload decodes and XOR-decrypts an inner Base64 script with a hardcoded key, then executes it.
3. Script reads `localStorage.getItem("csrfToken")` to authorize SOAP calls.
4. Run 12 async stages: sendStartPing, gather_email, gather_environment, gather_2fa_codes, gather_app_password, gather_device_status, gather_oauth_consumers, gather_autocomplete_password, enable_mail_protocols, gather_gal, sendArchives, sendFinishPing.
5. Fetch mail per day via GET `/home/~/?fmt=tgz&meta=0&query=date:-{DAY_OFFSET}d AND (not in:junk)` for offsets 0-89, marking `zd_comp_YYYY-MM-DD` in localStorage.
6. Exfiltrate via DNS A queries (Base32, dots every 60 chars, `d-` prefix) and HTTPS POSTs to `/v/p` (JSON) and `/v/d` (octet-stream, `X-Filename` header).
**Exploitation:** Phishing email sent from previously compromised accounts; victim only needs to view it in vulnerable ZCS. Script harvests CSRF token, creates an Application Passcode via `CreateAppSpecificPasswordRequest`, enables IMAP via `ModifyPrefsRequest` setting `zimbraPrefImapEnabled` TRUE, pulls 2FA scratch codes, brute-forces GAL with 20 batches of 77 `SearchGalRequest` calls, and exfiltrates 90 days of email as GZIP to actor VPS running Flowerbed/Catcher.
**Escalation:** Persistence via new Application Passcode plus IMAP enablement, enabling continued mailbox access beyond the session; 2FA scratch code theft and password-manager autocomplete harvesting extend account takeover.
**Insight:** Email HTML sanitizers that allow CSS `@import` can be abused to smuggle SVG `onload` JavaScript; test webmail rendering of CSS at-rules combined with SVG handlers, and note that a view-only email can yield full SOAP API access via the page's CSRF token in localStorage.