Introduction to Zoom’s Security Update

Video conferencing app Zoom has issued a new update alert after fixing multiple vulnerabilities affecting its Workplace apps. The fixes affect Zoom Workplace apps across various platforms, including Windows, macOS, Linux, iOS, and Android. The worst issue is a flaw tracked as CVE-2025-30663, which is ranked as having a high severity, according to Zoom’s security bulletin.

Details of the Vulnerabilities

The Zoom flaw is a time-of-check to time-of-use issue. This could, in theory, allow an attacker to modify or replace a file between it being checked and being used. The other vulnerabilities are ranked as having a medium severity. Among these, CVE-2025-30668 is an integer underflow issue in Zoom Workplace apps for Windows. Meanwhile, CVE-2025-46785 is a buffer over-read issue in Zoom Workplace apps for Windows. CVE-2025-30665 and CVE-2025-30666 are NULL pointer dereference issues in Zoom Workplace apps for Windows.

Impact and Risks

None of the flaws are known to have been used in real-life attacks. The Zoom patches come at a busy time for updates. Apple has issued iOS 18.5, fixing over 30 issues in its iPhone operating system, alongside other updates including iPadOS 17.7.7. Meanwhile, Microsoft’s Patch Tuesday addresses a number of important flaws.

Zoom Flaw Allows Attacker To Elevate Privileges

In total, there are nine Zoom flaws, the worst of which could allow an attacker to elevate privileges, says Erich Kron, security awareness advocate at Knowbe4. "Given the number of people that use and rely on Zoom for their organizations’ day-to-day activities, this type of flaw could be very significant,” he says. Since the pandemic, Zoom has remained a key communication tool for businesses globally. But as AI allows attackers to create fake images and videos, it’s difficult to know whether people are who they say they are.

Mitigating the Risks

Deepfake audio and video have already been an issue, and in this case having a Zoom meeting initiated from a legitimate account could be the difference between a person believing the caller and not believing them, says Kron. Fortunately, exploiting the Zoom flaw in question is not something that can be done easily remotely, he says. This means physical access to your device is required, which is obviously much more difficult for an adversary. “However, it demonstrates what may be possible with other future vulnerabilities that could be remotely exploited,” Kron says.

Conclusion

The Zoom updates cover multiple apps, so it’s a good idea to check your devices now. If the updates are available, apply them as soon as you can to keep your Zoom apps safe. By doing so, you can protect yourself from potential attacks and ensure a secure communication experience.

FAQs

• Q: What is the severity of the Zoom vulnerabilities?
  • A: The worst issue is ranked as having a high severity, while the others are ranked as having a medium severity.
• Q: Can the Zoom flaws be exploited remotely?
  • A: Fortunately, exploiting the Zoom flaw in question is not something that can be done easily remotely, and physical access to your device is required.
• Q: How many Zoom flaws have been fixed?
  • A: In total, there are nine Zoom flaws that have been fixed.
• Q: Are the flaws known to have been used in real-life attacks?
  • A: None of the flaws are known to have been used in real-life attacks.

Implementing Digital transformation strategies is crucial for retailers to stay competitive in today’s market. The COVID-19 pandemic has accelerated the shift to online shopping, and retailers must adapt to this new reality to survive. In this article, we will explore the key digital transformation strategies that retailers can use to thrive in a post-COVID era.

Understanding the New Retail Landscape

The retail landscape has undergone a significant transformation in recent years, driven by changes in consumer behavior and technological advancements. The COVID-19 pandemic has further accelerated this shift, with more consumers turning to online shopping and digital channels. Retailers must understand these changes and adapt their strategies to meet the new demands of consumers.

Changing Consumer Behavior

Consumers are now more digitally savvy than ever, with the majority of shoppers using online channels to research and purchase products. Social media platforms, online reviews, and influencers have become key factors in shaping consumer behavior. Retailers must understand these changes and develop strategies to engage with consumers across multiple channels.

Technological Advancements

Technological advancements such as artificial intelligence, blockchain, and the Internet of Things (IoT) are transforming the retail industry. These technologies offer retailers new opportunities to enhance the customer experience, improve operational efficiency, and gain a competitive edge. However, they also pose significant challenges, and retailers must invest in the right technologies to stay ahead.

Digital Transformation Strategies for Retailers

To thrive in a post-COVID era, retailers must develop and implement effective digital transformation strategies. These strategies should focus on enhancing the customer experience, improving operational efficiency, and driving business growth.

Omnichannel Retailing

Omnichannel retailing is critical for retailers to provide a seamless customer experience across multiple channels. This includes online, offline, and mobile channels, as well as social media and customer service. Retailers must integrate their channels to provide a consistent brand experience and enable customers to interact with them whenever and wherever they want.

Personalization and Customer Experience

Personalization is key to delivering a superior customer experience. Retailers must use data and analytics to understand customer behavior and preferences and tailor their marketing and sales strategies accordingly. This includes offering personalized recommendations, loyalty programs, and exclusive offers to loyal customers.

Supply Chain Optimization

Supply chain optimization is critical for retailers to ensure that products are delivered quickly and efficiently to customers. This includes investing in technologies such as artificial intelligence and blockchain to enhance supply chain visibility, reduce costs, and improve delivery times.

Employee Engagement and Training

Employee engagement and training are essential for retailers to deliver a superior customer experience. Retailers must invest in training programs that equip employees with the skills and knowledge they need to provide excellent customer service and support.

Implementing Digital Transformation

Implementing digital transformation requires a structured approach that involves several key steps. These include defining a clear vision and strategy, assessing current capabilities, and developing a roadmap for implementation.

Defining a Clear Vision and Strategy

Retailers must define a clear vision and strategy for digital transformation that aligns with their business goals and objectives. This includes identifying key areas for improvement and developing a roadmap for implementation.

Assessing Current Capabilities

Retailers must assess their current capabilities and identify areas for improvement. This includes evaluating their technology infrastructure, data analytics, and customer experience.

Developing a Roadmap for Implementation

Retailers must develop a roadmap for implementation that outlines key milestones and timelines. This includes identifying key stakeholders, assigning responsibilities, and establishing a budget for implementation.

Overcoming Challenges and Barriers

Digital transformation is not without its challenges and barriers. Retailers must overcome these challenges to ensure successful implementation and achieve their business goals.

Cultural and Organizational Barriers

Cultural and organizational barriers can be significant obstacles to digital transformation. Retailers must address these barriers by communicating the benefits of digital transformation, providing training and support, and encouraging a culture of innovation and experimentation.

Technological Barriers

Technological barriers can also be significant obstacles to digital transformation. Retailers must address these barriers by investing in the right technologies, developing a robust IT infrastructure, and ensuring that their systems are integrated and interoperable.

Conclusion

In conclusion, digital transformation is critical for retailers to thrive in a post-COVID era. By understanding the new retail landscape, developing effective digital transformation strategies, and implementing these strategies, retailers can enhance the customer experience, improve operational efficiency, and drive business growth. However, digital transformation is not without its challenges and barriers, and retailers must overcome these to ensure successful implementation and achieve their business goals.

Frequently Asked Questions (FAQs)

What is digital transformation in retail?

Digital transformation in retail refers to the integration of digital technologies into all areas of a retail business, including marketing, sales, customer service, and supply chain management.

Why is digital transformation important for retailers?

Digital transformation is important for retailers because it enables them to provide a superior customer experience, improve operational efficiency, and drive business growth.

What are the key digital transformation strategies for retailers?

The key digital transformation strategies for retailers include omnichannel retailing, personalization and customer experience, supply chain optimization, and employee engagement and training.

How can retailers overcome cultural and organizational barriers to digital transformation?

Retailers can overcome cultural and organizational barriers to digital transformation by communicating the benefits of digital transformation, providing training and support, and encouraging a culture of innovation and experimentation.

What are the benefits of digital transformation for retailers?

The benefits of digital transformation for retailers include enhanced customer experience, improved operational efficiency, increased revenue, and improved competitiveness.

Introduction to AI-Driven Attacks

AI can be a force for good when it comes to security protections, but also, increasingly, a force for bad. The latter has recently been exemplified in a multi-stage AI-driven attack against Microsoft Teams users, for example. As the name implies, Pen Test Partners is a company that specializes in security consulting, specifically penetration testing. These are professional hackers who can find the exact same routes to compromise your systems that the most advanced attackers would look to exploit. Those threat actors are increasingly using AI-powered attacks, so it makes sense for red team hackers to do likewise.

Red Team Penetration Testers Use Copilot AI To Hack Microsoft SharePoint

Pen Test Partners took a close look at how Microsoft’s Copilot AI for SharePoint could be exploited. The results were, to say the least, concerning. Not least considering an encrypted spreadsheet that the hackers were, quite rightly, rejected from opening by SharePoint, no matter what method was employed, was broken wide open when they asked the Copilot AI agent to go get it. “The agent then successfully printed the contents,” Jack Barradell-Johns, a red team security consultant with the security company, said, “including the passwords allowing us to access the encrypted spreadsheet.”

Access to Passwords

I would strongly recommend reading the full report for all the details of how the red team hackers exploited Copilot AI for SharePoint during their engagement, but I want to focus on the access to passwords, as that’s what has really grabbed my attention, and should grab yours as well. Barradell-Johns explained that during the engagement, the red teamers encountered a file named passwords.txt, located adjacent to an encrypted spreadsheet containing sensitive information. Naturally, they tried to access the file. Just as naturally, Microsoft SharePoint said nope, no way. “Notably,” Barradell-Johns said, “in this case, all methods of opening the file in the browser had been restricted.”

Circumventing Download Restrictions

So, what did the red team hackers do? Use the read team hacking mindset and ask the Copilot AI for Sharepoint agent to go and get it instead. “The agent then successfully printed the contents,” Barradell-Johns reported, “including the passwords allowing us to access the encrypted spreadsheet.” The download restrictions that are part of the restricted view protections were circumvented, and the content of the Copilot chats could be freely copied.

Microsoft Responds To Red Team Copilot AI SharePoint Hacking Report

I reached out to Microsoft, and a spokesperson said: “SharePoint information protection principles ensure that content is secured at the storage level through user-specific permissions and that access is audited. This means that if a user does not have permission to access specific content, they will not be able to view it through Copilot or any other agent. Additionally, any access to content through Copilot or an agent is logged and monitored for compliance and security.” I then contacted Ken Munro, founder of Pen Test Partners, who issued the following statement addressing the points made in the one provided by Microsoft.

Pen Test Partners Response

“Microsoft are technically correct about user permissions, but that’s not what we are exploiting here. They are also correct about logging, but again it comes down to configuration. In many cases, organisations aren’t typically logging the activities that we’re taking advantage of here. Having more granular user permissions would mitigate this, but in many organisations data on SharePoint isn’t as well managed as it could be. That’s exactly what we’re exploiting. These agents are enabled per user, based on licenses, and organisations we have spoken to do not always understand the implications of adding those licenses to their users.” And, you’d better believe, if there are any configuration holes, then Copilot AI will find them.

Conclusion

The use of AI-powered attacks by red team hackers has highlighted a significant vulnerability in Microsoft’s Copilot AI for SharePoint. The ability of the Copilot AI agent to circumvent download restrictions and access sensitive information, including passwords, is a concerning issue that needs to be addressed. While Microsoft has responded by stating that user permissions and logging are in place to protect content, Pen Test Partners has pointed out that configuration holes can be exploited by attackers. It is essential for organizations to be aware of these risks and take steps to mitigate them.

FAQs

• Q: What is Copilot AI for SharePoint?
  A: Copilot AI for SharePoint is a feature that uses artificial intelligence to assist users with tasks and provide information.
• Q: How did the red team hackers exploit Copilot AI for SharePoint?
  A: The red team hackers asked the Copilot AI agent to access a restricted file, which was then printed, including passwords, allowing them to access an encrypted spreadsheet.
• Q: What has Microsoft said about the issue?
  A: Microsoft has stated that user permissions and logging are in place to protect content, but Pen Test Partners has pointed out that configuration holes can be exploited by attackers.
• Q: What can organizations do to mitigate this risk?
  A: Organizations should review their user permissions and logging configurations to ensure that they are adequate and that they understand the implications of adding licenses to their users.