Zero-click email attacks: What businesses need to know

Zero-click attacks bring to mind the advanced spyware typically targeted at a specific subset of users. Infamous examples, such as the Pegasus spyware that targeted the family of murdered Saudi dissident Jamal Khashoggi, saw a user compromised simply by receiving a WhatsApp or iMessage.

But now, email is being used in a zero-click phishing campaign waged by Russian state-backed hackers, according to the UK’s National Cyber Security Centre (NCSC), which has issued an alert.

Targeting a vulnerability in the Zimbra Collaboration Suite (ZCS) software, the so-called ‘beehive’ attacks by Russian group Laundry Bear aim to steal email correspondence from organizations operating in critical sectors, according to the joint advisory.

Similar to the zero-click campaigns involving text messages, users only have to view a malicious email to be compromised.

Zero-click attack evolution

Zero-click used to mean “expensive, highly-targeted mobile exploits” used by nation-states for “silently dropping spyware” via WhatsApp or iMessage, says Matt Cooke, cybersecurity strategist at Proofpoint.

In the latest attacks, Laundry Bear – also known as TA488 and Void Blizzard – “has taken that mechanic out of the intelligence-gathering niche” and “turned it into a mass espionage tool aimed at the corporate inbox”, says Cooke.

His company has published a detailed breakdown of the new campaign.

Zero-click attacks such as these are concerning because they remove “the one thing firms have spent years training people not to do: Click the link”, says Rich Greene, certified instructor at SANS.

This type of activity is an evolution of attacks carried out via platforms such as WhatsApp and iMessage in highly targeted spyware campaigns, according to Greene.

“Moving those same ideas into email makes complete sense from an attacker’s perspective,” he said. Email is everywhere, businesses depend on it, and messages are constantly being processed in the background before the user ever decides whether to interact with them.”

How the email attacks work

In the Laundry Bear campaign, which likely used AI, viewing a crafted message in a vulnerable version of Zimbra webmail was enough to trigger the exploit. This would provide adversaries access while leaving the victim “with little reason to suspect anything had actually happened”, explains Alexander Leslie, a senior advisor at Recorded Future.

Analysis of the latest campaign found the techniques could be adapted to exploit vulnerabilities in other email software applications used by Western organizations.

The attackers initially exploited a flaw tracked as CVE-2025-66376 in Zimbra Collaboration Suite, but they later took advantage of a second vulnerability in Outlook Web Access, according to Cooke. “The group has shown it will scale a working technique, rather than retire it after one campaign,” he says.

The flaw is architectural, explains Cooke. “Email clients render HTML as browsers do. TA488 doesn't need a phishing hook; it hides malicious script fragments inside standard mail formatting.”

However, while mobile zero-click attacks often don’t require any interaction at all, the campaign does require users to open an email. Therefore, this would properly be described as a “half-click” exploit by researchers, says Cooke.

Who is a target?

The Zimbra campaign ran for at least five months against Ukrainian government entities and US defence, nuclear and research targets. During this time, adversaries exfiltrated information including 90 days of email, session tokens and saved credentials.

It’s notable how quickly TA488 moved on, says Cooke. “The day after an advisory on that campaign went public, researchers caught the same group already running the second exploit chain against Outlook Web Access, hitting government, telecoms, finance, hospitality and aerospace targets.”

The Outlook payload is “a step up in sophistication”, according to Cooke.

“It steals OAuth tokens through compromised mailbox add-ins and grants itself server-side folder permissions via a low-privilege default account. That access survives password resets and even a full device re-image, because it doesn't live on the endpoint at all.”

Going forward, the sectors most at risk are those that could be targeted by Russian intelligence. This includes defence, government, energy, law enforcement and media, says Leslie. Any organization holding politically, militarily, or commercially sensitive correspondence could be of interest, he adds.

Tackling zero-click email attacks

As zero-click attacks move from messaging to email, telling users not to click on links is no longer a valid response. Yet there’s no need to panic. The latest attacks are still very targeted and require unpatched flaws to compromise firms.

If you are in an at-risk sector, or if you use ZCS, there are a few steps you can take to reduce the risk. Greene believes organizations need to focus on the basics and “execute them well”.

The NCSC has advised ZCS users to patch immediately, as well as follow mitigation advice, use a third-party authentication service that supports passkeys where possible, and boost network monitoring capabilities.

“Patch quickly, keep email clients and operating systems up to date, reduce unnecessary message preview or content-processing features, monitor endpoints and accounts for unusual behaviour, and use layered email, identity and endpoint security controls,” adds Greene.

Defence in depth is becoming increasingly important, with many organizations using Microsoft Defender Suite for endpoint, email, application and identity protection, says Peter Jones, cyber security specialist at Conscia UK.

However, he believes it’s worth complementing these controls with behavior detection across the network and within the data center, using tools such as Cisco’s Secure Network Analytics or Secure Workload capabilities.

“When implemented correctly, Microsoft and Cisco Security tools can work well to provide the visibility to respond effectively in the event of a breach.”

As zero-click attacks continue to evolve, Cooke thinks the response must be “architectural”. He advises firms to patch webmail and Exchange promptly, but to also “assume patching will always trail behind zero-days”.

With this in mind, treat sessions and tokens as “short-lived by design”, he advises. “Shorten token lifetimes, and build identity monitoring that flags anomalous token behavior.”

Overall, he believes firms should plan for containment speed over prevention. “As TA488's Outlook campaign shows, once persistence is server-side, revoking a password isn't enough. Isolating and revoking the session, and auditing folder permissions and add-in access, is what actually closes the door.”