Russian hackers exploit Zimbra zero-click flaw for email theft

A zero-click cross-site scripting vulnerability in Zimbra Collaboration Suite (CVE-2025-66376) is being actively exploited by Russian state-sponsored actors to silently harvest emails, credentials, and MFA tokens without any user interaction. Because the flaw is triggered simply by receiving a crafted HTML email, traditional security awareness training provides no defense — the attack succeeds before a user can make a decision. The exfiltration of MFA tokens is particularly dangerous as it effectively nullifies a critical layer of authentication protection. This incident underscores that unpatched, internet-facing collaboration platforms represent a high-value, low-friction target for nation-state adversaries seeking persistent access to sensitive communications.