Context #
Zoom’s flagship AI feature is ZoomMate, an agentic chatbot that operates on data from across a user’s Zoom account and any connected services (e.g., OneDrive, Google, connectors, etc). The agent appears to have been given an environment with unrestricted HTTPS network access, with no user or admin-level configuration to lock it down.
In this article, we explore how a malicious Skill (or a prompt injection) can manipulate Zoom’s agent into connecting to an attacker’s server, allowing the attacker to issue their own commands and exfiltrate data from the victim’s tenant.
Further compounding this risk, the attacker’s connection can remain active even if the user clicks ‘stop’ on the agent and closes Zoom. Additionally, the final chat output to the user appears completely normal.
ZoomMate’s widely capable environment with internet access appears to be an intended functionality. There does not appear to be any specific vulnerability or programmatic component that is not working as intended to be disclosed to Zoom. We are publishing this article to inform users who may not be aware of the risk they are accepting by utilizing an agentic chatbot without strict network sandboxing.
The Attack Chain #
The victim asks for a report on their meetings for the week
The victim is using a Skill they have uploaded to Zoom
*Note: The attack in this article can also be conducted without a Skill, via indirect prompt injection (e.g., a hidden instruction Zoom ingests, such as an email).*Skills are typically distributed through online marketplaces and can be shared between users within Zoom; prior research shows that
attackers are up malicious Skills to these online registries.Note: Zoom does offer users a warning when up a Skill, but we do not believe it adequately informs them of the risks. The warning: “This skill is not from Zoom's official catalog and hasn't been verified by Zoom. Make sure you trust this skill's creator before installing.”### Zoom AI runs code from the malicious Skill
**Even if the user clicks the ‘stop’ button or closes Zoom, the attack does not stop because it continues to run in the agent’s environment on Zoom’s servers.**The code in the malicious Skill makes network requests (HTTPS) to an attacker’s server every few seconds, asking the server for commands to run. When the attacker sends a command, the script executes it in Zoom’s environment and sends the results back to the attacker’s server.
The attacker sends commands to exfiltrate meeting transcripts, messages, data from connectors, and more
Note: The attacker can target data from across Zoom that ZoomMate has access to, including connected data sources. It has not been confirmed whether the attacker can exploit Zoom’s browser integration to exfiltrate data from other websites.### A normal-looking report is delivered to the user, and the attacker stays connected