SideWinder Spoofs Chrome PDF Viewer, Zimbra to Steal Government Webmail Logins

Gbhackers •Mayura Kathir • April 21, 2026

SideWinder is running an active credential‑harvesting campaign that uses a fake Chrome PDF viewer and a pixel‑perfect Zimbra clone on Cloudflare Workers to steal government webmail credentials from South Asian targets, including the Bangladesh Navy and Pakistan’s Ministry of Foreign Affairs. The campaign came to light after a Cloudflare Workers URL was spotted harvesting credentials […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SideWinder Targets South Asian Governments with Phishing Campaign The advanced persistent threat group SideWinder has initiated a targeted phishing campaign aimed at South Asian government organizations, specifically targeting institutions like the Bangladesh Navy and Pakistan’s Ministry of Foreign Affairs. This campaign, which has been active since at least February 2026, employs a fake Chrome PDF viewer and a pixel-perfect clone of the Zimbra email login portal to harvest employee credentials. The attack was revealed after a Cloudflare Workers URL was identified as part of the credential-harvesting operation. The precise number of compromised accounts is currently unknown, but the scope of the attack raises significant concerns regarding the security of sensitive government communications. The phishing method is particularly sophisticated, mimicking legitimate platforms to deceive users. As of now, the campaign remains ongoing, with no reports of mitigation or remediation efforts detailed in the articles. 2 sources 73

Extracted Entities

SideWinder Spoofs Chrome PDF Viewer, Zimbra to Steal Government Webmail Logins

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (1)

Countries (2)

Industries (1)

MITRE ATT&CK (1)

Platforms (2)