A vulnerability in Zoom's Windows client could let attackers steal Windows login credentials of users who click on malicious links in chat messages
without Zoom asking for their permission or even notifying them that someone else was snooping on them https://www.nytimes.com/... Rogue P. Bigham / @jeffbigham : there's a lesson here... not sure what that lesson is yet, but there's a lesson — “Privacy experts said the company seemed to value ease of use ... over instituting default user protections.” https://www.nytimes.com/... Troy Hunt / @troyhunt : The good news is that flaw only impacts Mac users. The bad news is that this one impacts PC users: https://arstechnica.com/... Mike Elgan / @mikeelgan : Why is everyone using Zoom? Why is anyone using Zoom? https://twitter.com/... Amit Serper / @0xamit : 1. Link has to be clicked 2. Meeting has to be public for someone malicious to even join and post the link (which should probably be your in threat model anyhow) 3. This is how windows explorer works, it's vulnerable as well Conclusion: Stop using windows. #IHaveOpinions https://twitter.com/... Nilay Patel / @reckless : The biggest question facing Zoom is whether these gaffes are move-fast-break-things mistakes, or reflective of a deeper culture of disrespect for user privacy. Or... both. https://www.theverge.com/...
Context & Ripple Effects
This is the second client-level disclosure to hit Zoom in under a year. In July 2019 researchers showed a zero-day in the Mac client that let any website drag a user into a video call with the camera on and no permission prompt — the episode behind the privacy-expert critique, quoted here, that Zoom valued ease of use over default user protections.
The new Windows flaw escalates the stakes: instead of an unwanted call, a malicious chat link can silently hand attackers the victim's Windows login credentials. Troy Hunt's framing captures the pattern — the Mac issue was bad news for Mac users, this one for PC users — and it lands while Zoom's pandemic-era usage surge makes every client bug a mass-market event.
First-order effects
- Windows users who click malicious links inside Zoom chat expose their login credentials with no consent prompt or notification, making any inbound chat message a potential phishing vector.
- Zoom is pushed into another emergency response cycle on top of the patch it shipped days later for this same Windows flaw.
Second-order effects
- Rival collaboration clients come under the same lens: Microsoft separately patched a Teams flaw where malicious links or GIFs could hijack accounts, showing link-borne attacks are a category problem across meeting apps, not a Zoom-only one.
- Security researchers treat Zoom as a priority target — a year later Pwn2Own researchers demonstrated a remote code execution flaw against users mid-call, keeping the vendor in a continuous disclose-and-patch loop.
Third-order effects
- If chat links keep proving to be the softest entry point into desktop clients, meeting-software vendors face pressure to ship hardened defaults — sandboxed link handling and explicit consent prompts — rather than treating security toggles as friction.
- Recurring client vulnerabilities across Zoom and Teams point toward distribution-layer accountability: the platform whose client delivers the exploit increasingly owns the liability, not just the user who clicked.
The trend: As video conferencing became daily infrastructure, its desktop clients turned into a recurring attack surface, with link-based exploits forcing vendors from reactive patches toward hardened-by-default design.