Zimbra App-Specific Password 'ZimbraWeb' Created via CreateAppSpecificPasswordRequest

Ethan Andrews@eandrews

•updated Jul 23, 2026•1•0•11

Detects the creation of an app-specific password named 'ZimbraWeb' using the CreateAppSpecificPasswordRequest SOAP command in Zimbra logs. This technique is used to maintain persistent access to mailboxes while bypassing multi-factor authentication (MFA).