Roundcube webmail hack hits physics departments
A phishing attack targets Roundcube webmail users, stealing their login details and installing hidden backdoors to read their emails. Physics departments are the main victims.
- Report priority
- Medium
- Targets
- Roundcube Webmail
How it works
Attackers send fake Roundcube login pages to trick users into entering their email and password, then use those credentials to break into their real accounts.
What to do
Check if you got an email from an unknown sender asking you to update your Roundcube account, this is how the attack starts.
Do not click any links in suspicious emails. If you already entered your password on a fake page, change your Roundcube password immediately and check your account for any strange activity.
Technical details
A physics department employee gets an email that looks like it's from their university's IT team. It says their account needs updating and links to a fake Roundcube login page. When they type in their password, the attacker grabs it and logs into their real Roundcube account. Then the attacker installs a hidden program called a webshell to keep reading their emails without them knowing.
UNK_MassTraction chains two Roundcube flaws. CVE-2024-42009 is a cross-site scripting bug in message_body (through the latest version) that fires the moment a crafted email renders, delivering an info-stealer Proofpoint calls IceCube that Proofpoint says was likely built with LLM help. CVE-2025-49113 is a PHP object deserialization remote code execution flaw (before the patch) via the unvalidated from parameter in upload.php, used to drop a webshell named SquareShell disguised with a legitimate plugin's timestamp, which loads a stager called SNOWLIGHT that pulls the VShell backdoor into memory. Proofpoint ties the toolset and Chinese-language artifacts to a China-nexus cluster overlapping UNC5174, and reports fewer than 10 confirmed victims with a few dozen schools possibly affected since May 2026.
References
- securityonline.info · cavern-manticore-apt-modular-c2 SecurityOnline
- securityonline.info · busysnake-stealer-armored-likho SecurityOnline