Can a Phishing Email Steal Your Data Without a Click?

Most of us have been trained to spot phishing. Do not click the suspicious link. Do not open the unexpected attachment. Check the sender before you act. That advice is still worth following. 

But a cybersecurity advisory released in *July 2026 describes an attack where that advice may not have been enough, because simply viewing the email could trigger the exploit. The Canadian Centre for Cyber Security joined the U.S. National Security Agency and partners from more than a dozen countries in warning organizations about the campaign. 

Here is what happened, and why it matters even if your business does not use the affected software.

What Happened in the Zimbra Phishing Campaign?

In July 2026, the *Cyber Centre co-signed a joint advisory about a phishing campaign run by a Russian state-supported group tracked as LAUNDRY BEAR. The target was organizations using the Zimbra Collaboration Suite (ZCS), a business email and webmail platform. The attackers sent messages containing hidden malicious code that could run when the email was viewed in a vulnerable version of Zimbra’s webmail. The flaw, tracked as CVE-2025-66376, was exploited as a zero-day starting around July 2025 and was patched in November 2025.

To be clear about scope: this specific vulnerability affects organizations running vulnerable, unpatched versions of ZCS. If that is not your email system, you are not exposed to this exact flaw. But the lesson underneath it applies to any business that depends on email, which is to say nearly all of them.

What Makes This Different From Traditional Phishing?

Most phishing works by getting a person to do something: click a link, type a password into a fake page, open an attachment. Employee training is built around catching exactly those moments of decision. This campaign removed the decision. Because of the software flaw, the malicious code could execute when the message was simply displayed in the vulnerable webmail client. There was no link to resist and no attachment to avoid. Security researchers have described it as a “zero-click” attack for that reason.

It gets harder to spot. Since around November 2025, the attackers began sending these emails from real accounts they had already compromised, so the messages arrived from legitimate, familiar-looking senders. That is precisely the kind of email a careful employee, and many filtering tools, would be least likely to question.

Pro Tip: You cannot train someone to “not view” an email that is already sitting in their inbox. When the risk lives in the software that displays the message, the software behind the inbox has to be sound. Awareness is a layer, not the whole wall.

What Information Could Be Exposed?

According to the advisory, once triggered the exploit tried to collect and send back a substantial amount of data: the user’s previous 90 days of email, the organization’s shared contact directory (known as the Global Address List), a password saved through the browser’s autocomplete function, two-factor authentication recovery codes, and other sensitive account details. In plain terms, a single viewed message could hand an attacker months of correspondence plus the means to keep getting back in. For a typical Ottawa law firm or accounting practice, that could mean client information, contracts, and confidential communications being exposed without an obvious warning.

Did You Know: The Global Address List is essentially your company’s internal address book. Stealing it gives an attacker a ready-made list of colleagues, clients, and contacts to target next, which is how one compromise becomes many.

Why Multi-Factor Authentication May Not Be Enough

Multi-factor authentication (MFA) is one of the most effective protections a business can put in place. *Microsoft’s Digital Defense Report 2025 states that modern MFA prevents more than 99% of identity-based attacks, making it one of the most effective protections an organization can implement. But this campaign shows why MFA is a layer rather than a force field.

  • The attackers went straight for the things that let them work around it. 
  • They tried to steal 2FA recovery codes, and they attempted to create an “application passcode,” which is a special password meant for apps that cannot perform a normal MFA prompt.
  • Those recovery codes or the newly created application passcode could help an intruder bypass the normal MFA process and maintain access to the mailbox. 

The takeaway is not that MFA fails. It is that MFA works best when paired with secure account settings and monitoring that can catch an unexpected application passcode, authentication change, or unusual login. 

Key Note: MFA raises the bar considerably. Secure configuration and active monitoring make it even harder for attackers to work around that protection unnoticed.

What Should Organizations Using Zimbra Do Now?

If your business runs Zimbra, treat this as time-sensitive:

  • Confirm that you are running a current, supported, and fully patched version of ZCS. The original fix for CVE-2025-66376 was included in ZCS 10.1.13 and 10.0.18, but organizations should follow current Zimbra guidance rather than treating those older releases as the final destination. 
  • Review accounts for unusual activity: unexpected logins, unfamiliar locations, or settings that changed on their own.
  • Check for application passcodes nobody created, especially any named “ZimbraWeb,” which the advisory flags as almost certainly malicious.
  • Revoke application passcodes and 2FA recovery codes for affected users, and require password changes, since a saved password may already be gone.
  • Watch outbound network traffic for data heading to unfamiliar servers.

If indicators of this campaign are found, revoke application passcodes and 2FA recovery codes across the organization, require password changes, and determine whether other credentials stored through browser or password-manager autocomplete may have been exposed. 

What Can Other Small Businesses Learn From This Attack?

Even if you have never touched Zimbra, the pattern is the point. Any business-critical email system, whether it sits on your own server or is hosted for you, needs more than a savvy team. The durable lessons carry across every platform:

  • Keep email software patched and updated on a schedule, not whenever someone happens to remember.
  • Use unique passwords and MFA on every account.
  • Filter aggressively for spam and phishing at the gateway, before messages reach an inbox.
  • Keep logs long enough to actually investigate when something looks off.
  • Maintain tested backups so you can recover cleanly.
  • Have an incident response plan ready before you need it.

Credential theft is the thread running through all of it. According to Ottawa-based *Field Effect’s 2026 Cyber Threat Outlook, more than 80% of the incidents the firm investigated in 2025 involved attackers using valid or stolen credentials rather than breaking through a technical flaw. Protecting how your people sign in matters as much as protecting the software they sign in to.

How Managed IT Support Strengthens Email Security

This is a lot to stay on top of, and most small and medium businesses do not have someone whose full-time job is watching email systems for trouble. That is where a managed IT and cybersecurity partner earns its place. The right partner keeps your email platform patched and configured securely, monitors accounts and network traffic for the warning signs above, reviews settings so a stray app password or an unexpected protocol change gets noticed, and keeps a response plan ready if something looks wrong.

For a typical Ottawa small business, that turns email security from a worry you carry alone into a service that is quietly managed and monitored in the background.

If you are not certain whether your email system is patched and watched the way it should be, a short conversation with Firewall Technical at 613-288-5805 is a sensible place to start.

 

*Citations: