Security Challenges in Video Conferencing Applications: A Case Study on Microsoft Teams

Abstract

The rapid expansion of remote work and digital collaboration has positioned video conferencing platforms at the centre of organisational communication infrastructure. Microsoft Teams, with over 320 million monthly active users across more than one million organisations worldwide, has become a primary target for a wide spectrum of cyber threats. This paper investigates the security challenges inherent to video conferencing applications, with a focused case study on Microsoft Teams app. The research examines the threat landscape through five interconnected dimensions: technical vulnerabilities exploitable at the protocol and application layer; social engineering and phishing campaigns exploiting user trust within the platform; data privacy risks arising from inadequate encryption, misconfigured permissions, and insecure third-party integrations; regulatory compliance challenges under frameworks such as the GDPR and HIPAA and the human factors that amplify technological vulnerabilities. Based on peer-reviewed academic literature, official Microsoft security documentation, threat intelligence reports from organisations including Check Point Research and Microsoft DART, and disclosed CVE records, the paper constructs a comprehensive threat taxonomy. Specific attack techniques examined include the GIFShell attack chain enabling covert data exfiltration through legitimate Microsoft infrastructure, remote code execution vulnerabilities triggered via adversary-crafted meeting invitations, identity spoofing through webhook payload manipulation, and statesponsored social engineering campaigns attributed to the Midnight Blizzard threat actor. The paper further analyses the permission escalation risks within the Teams add-on ecosystem and the privacy side-channels introduced by virtual backgrounds and auxiliary devices. The findings reveal that the security posture of Microsoft Teams is compromised not solely by software defects but by systemic design trade-offs that prioritise usability and interoperability. Mitigation recommendations include technical hardening measures, governance frameworks, and user education programmes. This research contributes to the growing body of knowledge on enterprise collaboration platform security and provides practitioners with actionable guidance for securing video conferencing environments. CZU: 004.056:004.738.52; JEL: M15, K24, O33