Operation GhostMail: Russian APT Exploits Zimbra XSS to Target Ukraine Government

A sophisticated phishing campaign targeting a Ukrainian government agency exploits a cross-site scripting vulnerability in Zimbra Collaboration Suite. The attack, attributed to a Russian APT group, uses a seemingly innocuous internship inquiry email to deliver a malicious JavaScript payload. When opened in a vulnerable Zimbra webmail session, the script silently executes, harvesting credentials, session tokens, 2FA codes, and mailbox contents. The multi-stage attack employs obfuscation techniques, SOAP API abuse, and dual-channel exfiltration via DNS and HTTPS. The campaign demonstrates the evolution of webmail-focused intrusions, relying on browser-resident stealers rather than traditional malware binaries.

Pulse ID: 69b975d80c8af764ef55c18f
Pulse Link: https://otx.alienvault.com/pulse/69b975d80c8af764ef55c18f
Pulse Author: AlienVault
Created: 2026-03-17 15:40:08

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#2FA #Browser #CyberSecurity #DNS #Email #Government #HTTP #HTTPS #InfoSec #Java #JavaScript #Malware #OTX #OpenThreatExchange #Phishing #RAT #Russia #UK #Ukr #Ukraine #Ukrainian #Vulnerability #Webmail #XSS #Zimbra #bot #AlienVault

Update Service AU sites (#8548)

#2fa

https://github.com/2factorauth/twofactorauth/commit/507bf1157103869b832123c5efa8fd64dac8bf1f

Remove SMS from UC San Diego (#8551)

#2fa

https://github.com/2factorauth/twofactorauth/commit/958468d1e93f73ca84c1a7acb7a5b0ae09445159

Update Docusign (#8549)

#2fa

https://github.com/2factorauth/twofactorauth/commit/bde5f97f889dfe89016069d5777308d8c785dcc3

Update myGov (#8547)

#2fa

https://github.com/2factorauth/twofactorauth/commit/f90eea6ca67c29f061ef72f47e582eea6be691f2

Thinking back to that one time I had to enter a 2FA code and a Captcha popped up, so the code expired when I was finally able to submit it

#captcha #2fa

À propos #2FA @sebsauvage (https://sebsauvage.net/links/?YvTaEw)
conseille l'application mobile https://f-droid.org/fr/packages/com.beemdevelopment.aegis/

Free OTP+ reste un bon outil ou faut-il passer à un autre app ?

Cyberwar Mission: Hack the Adversary’s 2FA Protected Account

https://hackers-arise.com/cyberwar-mission-hack-the-adversarys-account-2/
#cybersecurity #infosec #2FA