The joint advisory for CVE-2025-66376 arrived July 22, signed by fourteen countries. It documented something that took a year to surface: a Russian state-backed actor called LAUNDRY BEAR had been harvesting 2FA tokens from Western government email accounts since July 2025, without ever attacking the MFA system. The flaw was in Zimbra Collaboration Suite. The attack vector was email preview.

No link click. No attachment open. Just view an email in Zimbra webmail, and LAUNDRY BEAR’s JavaScript runs in your authenticated browser session. From there: ninety days of stored email, all contacts in the Global Address List, stored passwords, application-specific passcodes, and the 2FA tokens your session holds. Synacor patched CVE-2025-66376 in November 2025. LAUNDRY BEAR had been running the campaign for four months before that patch existed.

The named victims span defense industrial base, federal and local government, law enforcement, and media, across more than ten Western organizations. Fourteen countries co-signed the advisory: NSA, FBI, CISA, and agencies from the Netherlands, UK, Australia, Canada, and nine others. That signature count is not routine. It signals that the observed scope understates the real one.

The Structural Failure

Organizations that deployed MFA on their Zimbra instances were protected against credential stuffing, password spraying, and phishing attacks targeting login credentials. Their MFA was working correctly. Every user who authenticated to Zimbra webmail did so through a valid MFA challenge. The tokens were correctly issued. The sessions were correctly authenticated.

LAUNDRY BEAR took the tokens after that. This is not an MFA bypass in the sense that most defenders plan for. The attack does not intercept the token in transit, abuse SS7, fatigue the user with push notifications, or use a real-time phishing proxy. The authentication protocol ran and succeeded. What LAUNDRY BEAR attacked was the authenticated session the protocol produces, which lives inside a webmail application that, by design, renders content from senders it has never authenticated.

The CVE-2025-66376 flaw arises from insufficient sanitization of CSS @import directives in email content. An attacker sends a specially crafted email. The recipient opens it for preview in Zimbra webmail. The @import directive causes JavaScript to execute in the context of the recipient’s authenticated session. That session holds email, contacts, credentials, and 2FA tokens. The JavaScript exfiltrates all of them. The email client’s job is to display email from strangers. That is what it did.

The MFA deployment model assumes that protecting the authentication step protects access. It does, for attackers who need to authenticate. LAUNDRY BEAR did not need to authenticate. It harvested the tokens from sessions that were already authenticated, via a channel (email content rendering) that sits inside the authenticated perimeter. The gap between what MFA protects (the login) and what LAUNDRY BEAR attacked (the post-login session) is where the campaign lived for twelve months.

What the Advisory Requires

The November 2025 Synacor patch is the remediation. Organizations that have not applied it are running a system with a confirmed, actively exploited XSS that enables complete session hijacking via email preview. The log review guidance in the advisory is critical and time-bounded: the intrusion window is July 2025 forward, and the pre-disclosure dwell means organizations should not assume their exposure started at the November 2025 patch date or the July 2026 advisory date.

The 2FA token component has specific detection implications. Standard 2FA bypass techniques target the token in transit: real-time phishing proxies that relay credentials and tokens between victim and legitimate service, SS7 interception of SMS tokens, SIM swapping. Controls designed to detect those techniques look for token interception between issuance and use. LAUNDRY BEAR’s approach skips that window: the token has already been used, the session is active, and the adversary reads the token from inside the authenticated session. Detection logic built around token interception does not cover token theft from a live session.

Defenders auditing for LAUNDRY BEAR compromise should review Zimbra server-side email handling and access logs for anomalous CSS @import patterns and unusual authentication activity dating to July 2025, not November 2025. If 2FA sessions were active on any potentially compromised mail server during that window, those sessions should be treated as having been read.

Authentication Infrastructure as the Contested Surface

LAUNDRY BEAR did not arrive in an otherwise quiet week. Microsoft’s July 2026 Patch Tuesday, published July 14, included two zero-days earning same-day CISA KEV additions: CVE-2026-56155 (Active Directory Federation Services, elevation of privilege, federal remediation deadline July 28) and CVE-2026-56164 (SharePoint Server, CVSS 5.3, confirmed active exploitation). SharePoint is now in its thirteenth week of multi-CVE exploitation, with more than 1,300 servers still unpatched past the original federal deadline. An Active Directory Certificate Services EoP (CVE-2026-54121, CVSS 8.8) shipped in the same batch with a public proof-of-concept.

ADFS is the identity broker for federated access across enterprise applications. AD CS issues the certificates that authenticate service accounts, users, and workstations. SharePoint integrates with both. Zimbra webmail authenticates via 2FA. These are different products from different vendors under different adversaries using different techniques, all targeting the authentication layer specifically.

That convergence reflects a strategic judgment that the authentication layer is worth attacking. Authentication infrastructure sits at a structural chokepoint: everything else in the environment trusts it. Compromise the authentication system, and that trust travels with the adversary. LAUNDRY BEAR did not compromise Zimbra’s authentication system at all. It compromised what an already-authenticated session could reach, from inside a rendering engine that processed attacker-controlled content. The result is the same: access without authentication.

The CVSS score for CVE-2025-66376 does not fully capture this. A cross-site scripting flaw in an email client might score moderate on base metrics while delivering the effective impact of a full authentication bypass against a multi-factor-secured account. Defenders prioritizing by CVSS on Zimbra advisories were under-weighting this one.

Where This Goes

LAUNDRY BEAR is not listed in the MITRE ATT&CK database, also tracked as Void Blizzard and CL-STA-1114, which limits automated correlation for defenders using TTP matching. That gap will close after the joint advisory, but teams relying on ATT&CK group identifiers for detection logic currently have no dataset to match against for this actor.

More significant is the technique class. Zero-click XSS in webmail clients that exfiltrates authenticated session contents is not a single campaign. Any webmail application that renders HTML email in an authenticated browser session and carries an XSS flaw is a candidate for this approach. Zimbra has the widest government deployment of any webmail platform outside Microsoft 365 and Google Workspace, but the technique generalizes across the vulnerability class, not the vendor.

The broader implication for authentication architecture is harder to address than any individual CVE. Webmail clients render attacker-controlled content inside authenticated sessions. That is a structural condition of how email works, not a configuration error. Authentication controls protect the session from being established without valid credentials. They do not protect the session from being read by code that executes inside it. Organizations that treat their webmail client as a communications tool rather than a privileged application carrying an authenticated session worth protecting are working from an incomplete threat model.

The email preview ran the payload. The 2FA session was already authenticated. The tokens were in the inbox.

Security Unlocked publishes weekly threat intelligence and strategic analysis. This post is based on intelligence collected July 21-27, 2026.