“Zero-click” WeChat worm could hijack accounts and spread via a single call
Researchers discovered a critical memory corruption flaw in WeChat's VoIP stack enabling a zero-click worm, WeWorm, that hijacks accounts via calls; Tencent patched it.
Calif researchers weaponized a memory corruption issue in WeChat's VoIP stack into "WeWorm", a worm that spreads through WeChat calls without user interaction, hijacks each victim's account, and propagates via saved contacts across iOS and Android, potentially reaching millions of devices within hours. Exploitation takes seconds and grants full account control, and chaining with other reported Android/iOS bugs could lead to full device control. Tencent issued updated WeChat versions for iOS and Android and applied server-side mitigations; technical details remain withheld. WeChat has over a billion users, overwhelmingly in China.
- Zero-click spread: worm triggers via incoming WeChat call, even unanswered unless declined within seconds
- Memory corruption in the VoIP stack; chained device bugs could yield full smartphone control
- Tencent patched via app updates and server-side mitigation; no user action required
- Researchers used AI to find the bug and write the RCE exploit in about two days
From the original article
2 min read at helpnetsecurity.com
Researchers with security company Calif have discovered, weaponized, and privately reported to Tencent a critical vulnerability that allowed them to create “WeWorm”, a worm that spreads via WeChat calls without any user interaction. During its rampage, the WeWorm compromises the WeChat account of each user, and uses the saved contacts to propagate itself further, potentially reaching millions of devices within hours.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.