US and allied cybersecurity agencies have warned that the Russian state-sponsored group Laundry Bear is exploiting a zero-click vulnerability in unpatched Zimbra Collaboration Suite email systems. Simply opening or previewing a malicious message can trigger the attack, making usual advice to avoid suspicious links and attachments insufficient; it matters because victims may not notice the compromise.

The hidden code can steal passwords, two-factor authentication data and up to 90 days of email messages. Authorities say the group has successfully targeted more than 10 Western organisations since July 2025, and urge organisations using affected Zimbra versions to apply security updates.