Loading malware…
SpyPress is a family of obfuscated JavaScript espionage payloads used in webmail compromise operations associated with the Russia-aligned threat actor Sednit, also tracked as APT28 and Fancy Bear, and by some reporting as TA458 in Operation RoundPress. It is designed to execute inside authenticated webmail sessions after exploitation of cross-site scripting and related client-side flaws in internet-facing mail platforms. Documented variants target Roundcube, Horde, Zimbra, MDaemon, and SOGo environments, with the malware adapted per platform while preserving a common objective of mailbox surveillance and data theft.
SpyPress is primarily used against high-value government, military, and defense-related targets, with repeated reporting on targeting of Ukrainian government entities and defense organizations in Eastern Europe, alongside additional activity against selected public-sector and strategic-sector organizations. The malware’s core behavior includes theft of webmail credentials, collection of email messages, harvesting of contact and address-book data, and reconnaissance of mailbox or platform configuration details. Some variants also capture login history, two-factor authentication material, or create application-specific passwords to preserve access to compromised accounts.
Delivery is tied to exploit-laden emails rendered in vulnerable webmail clients. In multiple campaigns, merely opening a crafted message in the web interface was sufficient to trigger execution, a technique often described as a half-click compromise because no link click or attachment execution was required. The payload runs in the victim’s browser context and abuses the active authenticated session to query webmail functions and export mailbox data. Exfiltration has been observed via HTTP POST requests to attacker-controlled infrastructure.
Although early SpyPress activity was centered on mailbox theft, later Roundcube-focused variants were modified to support longer-term access. Reported enhancements include creation of mail-forwarding rules and, in some cases, chaining client-side compromise with server-side exploitation to achieve arbitrary code execution and install fallback persistence or backdoor mechanisms such as webshells or reverse-shell style access paths. These developments indicate an evolution from session-bound espionage tooling toward broader post-exploitation on compromised mail servers.
SpyPress is best characterized as a webmail-focused infostealer used for cyber-espionage. Its operational role is to covertly extract sensitive communications and account data from targeted organizations while leveraging trusted webmail workflows and delayed patching of exposed collaboration infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
13 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
SpyPress is a family of malicious JavaScript payloads used by the Russia-aligned espionage group Sednit (APT28 / Fancy Bear) to compromise high-value webmail servers.
SpyPress is a family of malicious JavaScript payloads used by the Russia-aligned espionage group Sednit (APT28 / Fancy Bear) to compromise high-value webmail servers.
SpyPress is a family of malicious JavaScript payloads used by the Russia-aligned espionage group Sednit (APT28 / Fancy Bear) to compromise high-value webmail servers.
SpyPress is a family of malicious JavaScript payloads used by the Russia-aligned espionage group Sednit (APT28 / Fancy Bear) to compromise high-value webmail servers.
In March 2026, the group exploited a zero-day flaw in SOGo webmail, later patched as CVE-2026-8496 in version 5.12.8. | TA458 also continues using the SpyPress JavaScript malware, adapting it to different webmail platforms to support espionage and email theft.
SpyPress uses a second Roundcube exploit (CVE-2025-49113) that abuses Roundcube's file upload handler to trigger unsafe PHP deserialization. The end goal is to trigger arbitrary code execution and install multiple backdoor or persistence mechanisms. | TA458 continues to use SpyPress - an obfuscated JavaScript-based malware seen in Operation RoundPress - which the adversary modifies based on the targeted mail server.
Observed targets now span Zimbra (CVE-2025-27915), mDaemon (CVE-2025-3929), Roundcube (CVE-2024-42009, CVE-2023-43770), Kerio, and SOGo (CVE-2026-8496). | TA458 runs the operation ESET named RoundPress. Its SpyPress malware adapts to whichever platform it lands on.
In total, Proofpoint has observed TA458 exploiting the following webmail vulnerabilities: CVE-2024-42009: Roundcube (n-day) | TA458 continues to use SpyPress - an obfuscated JavaScript-based malware seen in Operation RoundPress - which the adversary modifies based on the targeted mailserver.
Observed targets now span Zimbra (CVE-2025-27915), mDaemon (CVE-2025-3929), Roundcube (CVE-2024-42009, CVE-2023-43770), Kerio, and SOGo (CVE-2026-8496). | TA458 runs the operation ESET named RoundPress. Its SpyPress malware adapts to whichever platform it lands on.
Анатомия JavaScript implant: SpyPress и Roundish toolkit. По данным Hunt.io (Operation Roundish) и ESET (Operation RoundPress), JavaScript implant выполняет до шести операций за одну XSS-инъекцию.
"...Roundcube (CVE-2023-43770), and Zimbra (CVE-2024-27443) leveraged security defects already known and patched..." | Successful exploitation leads to the execution of an obfuscated JavaScript payload named SpyPress that comes with the ability to steal webmail credentials and harvest email messages and contact information from the victim's mailbox.
Successful exploitation leads to the execution of an obfuscated JavaScript payload named SpyPress that comes with the ability to steal webmail credentials and harvest email messages and contact information from the victim's mailbox.
Successful exploitation leads to the execution of an obfuscated JavaScript payload named SpyPress that comes with the ability to steal webmail credentials and harvest email messages and contact information from the victim's mailbox.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
2026-07-23 ⋅ Proofpoint ⋅ Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days from TA458 SpyPress
SpyPress is a family of malicious JavaScript payloads used by the Russia-aligned espionage group Sednit (APT28 / Fancy Bear) to compromise high-value webmail servers.
We identified 14 TTP overlaps between the Roundish toolkit and ESET's documented Operation RoundPress campaign... Its presence in both SpyPress and Roundish strongly suggests a shared developer or development playbook.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Titles such as “Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days” and “DealersChoice is Sofacy’s Flash Player Exploit Platform” describe browser/webmail-triggered exploitation.
The disclosure also follows a report from Proofpoint about Russian threat actor's continued webmail targeting using half-click cross-site scripting (XSS) exploits to siphon valuable data as part of a campaign referred to as Operation RoundPress.
Mail forwarding - скрипт addRedirectMailBox.js создаёт правило пересылки на контролируемый адрес... Это persistence без бэкдора
Credential harvesting - инъекция скрытых полей username/password с visibility:hidden и autocomplete=on . При любом клике пользователя перехватываются значения, автозаполненные менеджером паролей браузера.
Credential harvesting - инъекция скрытых полей username/password с visibility:hidden и autocomplete=on . При любом клике пользователя перехватываются значения, автозаполненные менеджером паролей браузера.
Email exfiltration - выгрузка писем через Roundcube API viewsource с base64-кодированием и HTTP POST на C2.
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
JavaScript malware used by TA458 against webmail platforms to support espionage and steal sensitive email data.
An obfuscated JavaScript-based malware used in Operation RoundPress and adapted per targeted mail server; later variants added interactive backdoor mechanisms for long-term access.
A cross-platform espionage malware used in TA458's RoundPress activity against webmail platforms. It adapts to the target platform and attempts multiple persistence methods, including reverse shells and dropped webshells, to maintain long-term access after exploitation.
Named malware/tool associated with Operation RoundPress and TA458; exact functionality is not described in the provided content.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.