The attackers had cleverly exploited a loophole in Zoom's verification process, which allowed them to create a verified bot without proper scrutiny. The bot's verification status gave it an air of legitimacy, making it harder for Zoom's security systems to detect.