“New ‘Zoomsday’ Hack Revealed with Under 20 AI Prompts”

Zoom has rolled out a critical security update to address a vulnerability that could let an attacker take control of a device during a meeting. Researchers from A Security revealed in a recent blog post that they discovered this flaw using “fewer than 20 prompts on publicly available AI models,” as previously noted.

The issue was linked to Zoom’s annotation feature, which enables users to draw on their screens while sharing with others. This exploit allowed an attacker to either join or host a meeting and execute malicious code on the devices of participants, potentially leading to data theft, unauthorized access to cameras or microphones, or the installation of malware. Victims were not required to take any action, and there were “no visual cues indicating the compromise,” according to A Security.

“Producing a working exploit against it has always been nation-state work: elite teams, months of effort, budgets that governments regulate as weapons,” stated Idan Levcovich, a vulnerability researcher at A Security, in the blog post. “A [Security] did it in a single day, with an AI agent and models anyone can access today.” Zoom has implemented a fix for this vulnerability, which affected the app on Windows, macOS, Linux, Android, and iOS.