Hackers are running a worldwide cyberespionage campaign dubbed 'RoundPress,' leveraging zero-day and n-day flaws in webmail servers to steal email from high-value government organizations. A malicious JavaScript payload embedded in the HTML body of the email triggers the exploitation of a cross-site scripting (XSS) vulnerability in the webmail browser page used by the recipient. All that is needed from the victim is to open the email to view it, as no other interaction/clicks, redirections, or data input is required for the malicious JavaScript script to execute. Additionally, it reads the DOM or sends HTTP requests to collect email message content, contacts, webmail settings, login history, two-factor authentication, and passwords. Operation RoundPress targeted multiple XSS flaws in various webmail products that important organizations commonly use to inject their malicious JS scripts. Although ESET does not report any RoundPress activity for 2025, the hackers' methods could be easily applied to this year too, as there's a constant supply of new XSS flaws in popular webmail products. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. The script creates invisible input fields to trick browsers or password managers into autofilling stored credentials for the victim's email accounts. Notable targets include governments in Greece, Ukraine, Serbia, and Cameroon, military units in Ukraine and Ecuador, defense companies in Ukraine, Bulgaria, and Romania, and critical infrastructure in Ukraine and Bulgaria. The attack starts with a spear-phishing email referencing current news or political events, often including excerpts from news articles to add legitimacy. ESET researchers who uncovered the operation attribute it with medium confidence to the Russian state-sponsored hackers APT28 (aka "Fancy Bear" or "Sednit"). The payload has no persistence mechanisms, so it only executes when the malicious email is opened.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 15 May 2025 19:14:55 +0000