WeChat worm could pwn a friend before they even answered the call
Calif researchers demoed WeWorm, a zero-click WeChat VoIP memory-corruption worm enabling account takeover; Tencent patched it August 21.
Security firm Calif found a memory corruption bug in WeChat's VoIP stack that let a trusted contact take over a user's account simply by calling them, without the call being answered. The demo worm then called the victim's contacts to self-propagate across iOS and Android; declining the call prevented infection. Tencent pushed fixes on August 21, and Calif said chaining the bug with other Android and iOS flaws could yield full device control. Calif used AI to find the vulnerability and build its first RCE exploit in about two days.
- WeChat has over 1.4 billion monthly active users, amplifying potential worm impact.
- Exploit takes seconds and grants full account control: reading and sending messages, making calls.
- Attacker must be on the victim's friends list, but compromised accounts can target trusted contacts.
- Chaining with bugs like OEMpocalypse techniques could compromise entire devices.
- Full technical analysis is planned for presentation at an upcoming conference.
- Organizations
- TencentCalifGeorgetown University
- Countries
- ChinaUnited States
From the original article
2 min read at theregister.comCalif says AI helped turn a VoIP memory bug into cross-platform RCE before Tencent shut it down
By Connor Jones · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.