SideWinder Uses Fake Chrome PDF Viewer and Zimbra Clone to Steal Government Webmail Credentials

Cybersecuritynews •Tushar Subhra Dutta • April 21, 2026

A well-known advanced persistent threat group called SideWinder has launched a highly targeted phishing campaign against South Asian government organizations, using a fake Chrome PDF viewer and a pixel-perfect clone of the Zimbra email login portal to steal employee credentials. The campaign, active since at least February 2026, has been targeting sensitive institutions including Bangladesh […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SideWinder Targets South Asian Governments with Phishing Campaign The advanced persistent threat group SideWinder has initiated a targeted phishing campaign aimed at South Asian government organizations, specifically targeting institutions like the Bangladesh Navy and Pakistan’s Ministry of Foreign Affairs. This campaign, which has been active since at least February 2026, employs a fake Chrome PDF viewer and a pixel-perfect clone of the Zimbra email login portal to harvest employee credentials. The attack was revealed after a Cloudflare Workers URL was identified as part of the credential-harvesting operation. The precise number of compromised accounts is currently unknown, but the scope of the attack raises significant concerns regarding the security of sensitive government communications. The phishing method is particularly sophisticated, mimicking legitimate platforms to deceive users. As of now, the campaign remains ongoing, with no reports of mitigation or remediation efforts detailed in the articles. 2 sources 73

Extracted Entities

SideWinder Uses Fake Chrome PDF Viewer and Zimbra Clone to Steal Government Webmail Credentials

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Industries (1)

Platforms (2)