Russian state hackers steal 90 days of email on open, no click required

Ninety days of archived email, along with passwords and two-factor authentication tokens, flows to attacker-controlled servers the moment a vulnerable Zimbra webmail client renders a malicious message, according to a joint advisory from…