OTX Threat: Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days

TA458, a Russia-aligned espionage group likely linked to GRU, continues exploiting half-click cross-site scripting vulnerabilities in webmail platforms to steal sensitive email data. These exploits require no user interaction beyond opening the malicious email in webmail. The actor exploited multiple zero-days including SOGo (CVE-2026-8496), Zimbra (CVE-2025-27915), and mDaemon (CVE-2025-3929), al CVEs: CVE-2023-43770, CVE-2024-42009, CVE-2025-3929, CVE-2025-49113, CVE-2025-27915 Sectors: Govern