[FORECAST] The next inbox breach will be a collection pipeline

In July 2026, U.S. and allied cyber agencies described a Russian state-supported campaign against Zimbra, an email and collaboration platform used by government and commercial organizations. On a vulnerable webmail system, viewing a crafted message could run attacker code inside the user’s signed-in browser session. That code attempted to collect the previous 90 days of mail and the organization’s address directory, then establish continued access. This is why the incident is more than a mail-server patch story: the attacker tried to turn an ordinary inbox into a collection system. [1]

Microsoft had already reported that an overlapping Russian-affiliated cluster it calls Void Blizzard collected large volumes of email and files using cloud access. The entry routes differ. The intelligence objective—repeatable access to other people’s communications—does not. [2]

The call: We put a 58% probability on a new, publicly documented state-backed mail-collection campaign by June 30, 2027. This forecasts a qualifying public report about a distinct operation, not the first occurrence of an intrusion. Confidence in the inputs is medium.

The decision is not simply whether the mail server is patched. It is who can prove what happened after a session, credential, or API call began collecting. A green patch dashboard does not answer which messages left.

The fast scan

• Observed: The Zimbra advisory documents browser-side exploitation, mail and directory collection attempts, and persistence; Microsoft documents high-volume collection through cloud access. These are already-public cases, not a future resolution. [1][2]
• Assessed: Another distinct operation has a better-than-even chance of being disclosed with enough attribution and collection detail by the deadline. That is an editorial probability, not a measured frequency of attacks.
• Uncertain: The operation might happen and never be published—or be reported only as phishing, without proof of automated collection.
• Move now: Have messaging and IAM identify the logs and retention needed to reconstruct mailbox reads, directory queries, and new durable access; ask the SOC to test one account across those surfaces.

One clean win: Pick a recently investigated suspicious sign-in. Can your team reconstruct subsequent mailbox access and any app-password or mail-scoped OAuth changes without opening four unrelated tickets? If not, the gap is an ownership decision, not an analyst failure.

Below the tear: A compact way to assign that ownership, decide when a mail event becomes a collection investigation, and know which new disclosure would actually change this forecast.

Give collection its own incident threshold

An account takeover alert tells you an identity crossed a boundary. It does not tell you whether an intelligence service has turned that account into a repeatable mail-export channel.