Operation GhostMail Uses Zero-Click XSS to Target Ukrainian Government Webmail
Summary
Seqrite Labs reports Operation GhostMail exploited CVE-2025-66376 in Zimbra through HTML-only email to target Ukraine’s State Hydrology Agency, harvesting session and mailbox data. APT28 attribution is assessed with moderate confidence.
Key points
- Seqrite Labs reported a zero-click campaign delivered in an email’s HTML body, without attachments or suspicious links.
- The campaign reportedly exploits CVE-2025-66376 in Zimbra through inadequate sanitization of CSS @import directives, enabling obfuscated JavaScript execution.
- The article names Ukraine’s State Hydrology Agency as the target and attributes the operation to APT28 with moderate confidence.
- The reported script targets session tokens, backup 2FA codes, saved passwords, up to 90 days of mailbox content, and contacts.
- The report says the browser-resident script uses DNS and HTTPS channels for exfiltration and does not drop files.
Article Details
- Event Type
- Reported zero-click cyberespionage campaign exploiting a stored XSS vulnerability in Zimbra Collaboration (ZCS).
- Impact
- Seqrite Labs reports that the campaign targeted the Ukrainian State Hydrology Agency. The browser-resident script was designed to intercept webmail sessions and exfiltrate session tokens, backup 2FA codes, saved passwords, mailbox contents from the prior 90 days, and contact lists via DNS and HTTPS. Attribution to APT28 is stated with moderate confidence.