Zoom Client Leaks Windows Login Credentials to Attackers - by @LawrenceAbrams
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
Security researchers @_g0dmode and @hackerfantastic revealed tonight that the Zoom client is vulnerable to UNC injection that can be used to steal Windows login credentials or attempt to launch a program.
When using Zoom's built-in chat feature, users can send URLs that are automatically converted into clickable hyperlinks. It was also discovered that UNC paths can also be sent and automatically converted to clickable links. 
When these links are clicked on, Windows will perform the default actions associated with the link. For URLs, it will open the associated web page with the default browser. For UNC paths, it will attempt to connect to the remote share.
When connecting to remote shares, by default Windows will send a user's login name and information that can be used to recreate the user's NTLM password hash.
If the clicked on UNC server is operated by bad actors, they can sniff the traffic to capture users Windows login credentials as shown by below.
Once a threat actor gains access to the NTLM hash, it's as simple as running it through Hashcat to dehash the password. Now the threat actor has both the user's login name and password.
In addition to NTLM credentials theft, the UNC links can also be used to attempt to launch an executable on a person's computer when they click on a link.
To fix this, Zoom has to make it so UNC paths are not automatically converted into clickable links. Zoom has been notified of this flaw and will most likely issue a new client release soon to fix the issue.
If you do not want to wait for the fix, you can also configure the 'Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers' group policy and set it to 'Deny All' to prevent Windows from automatically sending your login credentials.
Article updated with statement from Zoom that they are addressing the UNC issue. Added further information on how DOS device paths can be used to execute a command without showing a MoTW prompt as discovered by @taviso.
