Russian Espionage Groups Exploit Webmail Flaws for Half-Click Account Takeovers

Russia-aligned espionage groups TA458 and TA488 have been exploiting vulnerabilities in webmail platforms including Roundcube, Zimbra, SOGo, mDaemon, Kerio, and SOGo to compromise government and defense targets through so-called "half-click" attacks, where opening a malicious email in a webmail session triggers attacker-controlled JavaScript. Proofpoint reported TA458 used a SOGo zero-day later patched as CVE-2026-8496, while TA488 exploited a previously unknown Zimbra flaw assigned CVE-2025-66376 for months. The campaigns targeted Ukrainian government entities, Eastern European military and government organizations, and parts of the U.S. defense industrial base and nuclear sector, with malware such as SpyPress and ZimReaper stealing credentials, contacts, emails, CSRF tokens, and app-specific passwords to bypass multifactor protections.

Reporting on APT28 infrastructure exposed in early 2026 tied the broader Operation RoundPress activity to a larger webmail espionage program that relied heavily on patched but unremediated flaws, including CVE-2020-35730, CVE-2023-43770, CVE-2021-44026, and CVE-2020-12641 in Roundcube. Researchers said the leaked toolkit included XSS payloads, a Flask-based command-and-control server, a Go implant for GNU/Linux, operator bash history, and victim data, revealing poor operational security and overlap between staging, exfiltration, and pivot infrastructure. TA458 was also observed chaining a Roundcube XSS vector with CVE-2025-49113 to achieve PHP deserialization and arbitrary code execution, showing that the actors are pursuing not only mailbox theft and forwarding-rule abuse but also persistent server-side access.