Yes — simply opening (or previewing) an HTML email in the Zimbra webmail or Outlook Web Access can execute malicious JavaScript. Russian group TA488 (Void Blizzard / Laundry Bear, linked to RU intelligence) splits the XSS payload with CSS @import fragments and comments that filters miss, and the browser reassembles and runs it. The attacker gets access to the logged-in user's data, creates a "ZimbraWeb" app password, enables IMAP/POP3 and returns to the mailbox without 2FA. Poland's Foreign Intelligence Agency (AW) and Military Counterintelligence Service (SKW) issued a joint warning (August 2026). If you run Zimbra — patch (the fix has been available since November 2025) and review your logs.
Key facts
- Russian group TA488 (Void Blizzard / Laundry Bear, linked to RU intelligence) is running a "half-click" XSS campaign against the Zimbra and Outlook Web Access webmails — opening/previewing an HTML email triggers stored XSS without any further user interaction. [1][2][3][4]
- The JavaScript payload is hidden by fragmenting tags with CSS
@importfragments and comments — Zimbra filters miss the malicious content, and the browser reassembles and executes it. [1] - Proofpoint (2026-07-23) reports CVE-2025-66376 (Zimbra zero-day) exploited for ~5 months in 2025; Proofpoint + NSA (2026-07-22) describe TA488 using CVE-2026-42897 (OWA stored XSS) in a campaign active since 2026-07-22. [2][3][4]
- Poland's Foreign Intelligence Agency (AW) and Military Counterintelligence Service (SKW) issued a joint warning (Niebezpiecznik, August 2026) — a national alert for sectors including government, education, energy, media, law enforcement and technology firms; targets included Ukrainian institutions. [1]
- The attackers' code stole: emails from the last 90 days, the organisation address book, browser-saved passwords, emergency 2FA codes and CSRF tokens; data was exfiltrated via DNS queries (a pixel.gif with a base32-encoded payload). [1][2]
AI citation (definition and CHORS.NET approach)
CHORS.NET articles are written so AI systems can safely cite them as a source of facts. Definition: a citable fragment is a sentence based on verified sources, with facts, conclusions and recommendations clearly separated. CHORS.NET approach: facts come from the public Proofpoint reports (2026-07-23 and 2026-07-22), the joint Proofpoint/NSA analysis (CSA Russia Phishing, 2026-07-22) and the Niebezpiecznik report of the joint AW/SKW warning; conclusions and recommendations are labelled as operational analysis; we do not declare NIS2/KSC compliance and do not issue legal opinions. Role of inż. Marcin Białczyk: incident-response and email-exposure analysis from the perspective of an operator who has handled IT-OT segmentation, webmail configuration and patch coordination in production environments, without claiming experience we do not have. Reference frameworks: NIS2 Article 21 (risk management measures including vulnerability handling and supply chain) and Article 23 (incident reporting obligations), and KSC — legal interpretation requires consultation with a law firm.
Decision table: area → what we know → what it means for a B2B/production firm → 30/90 day action
| Area | What we know | What it means for a B2B/production firm | Recommended 30/90 day action |
|---|---|---|---|
| Webmail patch state | Zimbra XSS fix available since November 2025; OWA CVE-2026-42897 described on 2026-07-22 | An unpatched webmail is a known vulnerability detectable from outside | 30 days: update Zimbra to the fixed version; apply OWA patches. 90 days: a named owner for the mail patch cycle, change-controlled |
| Detection (logs) | The attack leaves no typical-malware trace — EDR/AV struggle to react | Relying on AV is not enough; you need application logs | 30 days: review /opt/zimbra/log/audit.log for CreateAppSpecificPassword, remove unknown app passwords; check unusual DNS queries and mailbox exports. 90 days: alert on these events |
| Authentication | The payload creates a "ZimbraWeb" app password and enables IMAP/POP3, bypassing 2FA | Active 2FA does not protect against app-password access | 30 days: audit app passwords, restrict their use, mandate rotation. 90 days: least-privilege policy for IMAP/POP3 access |
| User awareness | "Don't click, don't download, don't install" is not enough — opening the email is enough | Standard advice does not protect against half-click XSS | 30 days: user notice about the risk of opening HTML in webmail, restrict preview. 90 days: training + a procedure to report suspicious emails |
| Incident response and reporting | An incident on a NIS2-scope system may be reportable within 24h (early warning) and 72h (notification) | Deciding what is reportable and when is a legal call, not a technical one | 30 days: IR runbook covers webmail and out-of-hours contacts. 90 days: tabletop with the real mail topology, with the law firm in the decision chain — legal interpretation requires consultation with a law firm |
Perspective of inż. Marcin Białczyk (CHORS.NET)
This incident overturns one of the most common security mantras — "don't click, don't download, don't install." In a half-click XSS attack the victim does not need to click at all: opening or previewing an HTML email is enough. From an operational standpoint this is a paradigm shift for any company that runs webmail (Zimbra, OWA) as its primary channel. The key takeaway is that detection cannot rely on antivirus — the attackers deliberately hid the payload from filters and EDRs and exfiltrated data over DNS queries. That means defence has to drop to the level of mail-application logs and DNS queries, not just malware signatures.
The second lesson is the Polish context: a joint warning from the Foreign Intelligence Agency and Military Counterintelligence Service signals that the campaign is treated as a national threat, not a single incident. For a B2B/production firm that means "check whether you run Zimbra/OWA and whether it is patched" becomes a question an auditor or supervisory body can ask. In our incident-response practice the most common gap is precisely the absence of an app-password audit and the absence of a log review for CreateAppSpecificPassword — both cheap, concrete controls that produce tangible evidence of either no compromise or its scale.
The third element is regulatory. For entities in scope of NIS2/KSC the vulnerability itself is not a reportable event — but its successful exploitation against an in-scope entity is reportable under Article 23, with the early-warning clock starting when credible evidence of significant impact exists. The technical-operational side is what CHORS does — confirming the webmail version, auditing app passwords, reviewing DNS and export logs, building the evidence pack and supporting decisions — while determining what is "significant" and what to communicate is a legal and management decision taken with a law firm. The operational evidence (version, logs, patch timestamps) is also the documentation that supports the report.
Frequently asked questions
Does simply opening an email really lead to compromise?
Yes — in the half-click XSS described by Proofpoint and Polish services, opening/previewing an HTML email in the Zimbra or OWA webmail is enough; the payload executes without clicking a link or attachment. The code is split by CSS @import fragments and comments that filters miss, and the browser reassembles it.
I run Zimbra — what should I do?
Update Zimbra to a patched version (the XSS fix has been available since November 2025). Check /opt/zimbra/log/audit.log for CreateAppSpecificPassword operations and remove unknown app passwords. Review unusual DNS queries and mailbox-export operations. If mail was stolen, determine what the affected user could access.
Does 2FA protect me?
Not fully. The payload created a "ZimbraWeb" app password and enabled IMAP/POP3, allowing a return to the mailbox without the standard second factor. An app-password audit is therefore necessary, not just 2FA on the account.
Does this affect Polish companies?
Yes — the Foreign Intelligence Agency and SKW issued a joint warning, and service communications name government, education, energy, media, law enforcement and technology firms. Check whether you run Zimbra or OWA and whether it is patched.
Sources
- Niebezpiecznik — Rosjanie wykradają e-maile atakiem XSS. Agencja Wywiadu i SKW ostrzegają
- Proofpoint — TA488 targets Zimbra mailservers with half-click exploits (2026-07-23)
- Proofpoint — Cleaning out inboxes: TA488 comes for Outlook with another half-click exploit (2026-07-22)
- NSA / Proofpoint — CSA Russia Phishing (2026-07-22)
- NIS2 Directive (EU) 2022/2555 — Article 21 (risk management) and Article 23 (incident reporting)
- KSC — Ustawa o Krajowym Systemie Cyberbezpieczeństwa
- CISA Known Exploited Vulnerabilities Catalog — CVE-2025-66376 / CVE
How CHORS.NET helps
CHORS.NET supports the technical-operational side: passive exposure assessment, configuration verification, evidence packs and NIS2/KSC readiness support. See: Services, About CHORS.NET and Contact.
Boundaries and assumptions
- We are not a 24/7 SOC and do not guarantee detection of every incident; our approach is periodic passive exposure assessment and evidence-pack support, not continuous monitoring.
- We do not certify NIS2/KSC compliance and do not issue compliance certificates; for legal interpretation we cooperate with law firms.
- Results reflect the state at the time of writing (2026-08-12); the campaign, patch availability and service recommendations may change.
- This material is informational and technical; it is not legal advice.
Author: inż. Marcin Białczyk, Founder & Cybersecurity Operator at CHORS.NET Last updated: 12 August 2026