Researchers Build WeChat Zero-Click Worm Hijacking Phones via Calls
Calif researchers built WeWorm, a zero-click worm exploiting a WeChat VoIP memory-corruption RCE that Tencent has now patched.
Calif researchers found a memory corruption flaw in WeChat's VoIP stack in July using LLM-assisted analysis and built working exploits within two days, then integrated them into WeWorm, which they call the first zero-click worm spreading through WeChat calls on iOS and Android. A crafted incoming call yields remote code execution with no user interaction, giving full control of the victim's WeChat account; the attacker only needs to be on the victim's friend list, easily achieved by compromising a contact first. Tencent confirmed the bug and shipped patches in WeChat Android 8.0.77 and iOS 8.0.76, and chaining with other OS bugs could yield full device control.
- Zero-click exploit succeeds even if the victim never answers the call
- Worm spreads by compromising trusted contacts and calling their friends
- Patched in WeChat Android 8.0.77 and iOS 8.0.76
- Vulnerability discovered with help of open-weight and frontier LLMs
- No in-the-wild exploitation reported; tested on test phones
Full article473 words · extracted from infosecurity-magazine.com · click to collapse
A team of researchers at Calif, a cybersecurity startup based in Palo Alto, California, has built a tool capable of hacking Android and iOS phones via a simple incoming call.
The hacking tool, dubbed WeWorm, relies on the exploitation of remote code execution (RCE) vulnerabilities in WeChat, a Chinese super-app that allows users to exchange messages, calls, make purchases, place transactions and more.
It is “the first zero-click worm to spread through WeChat calls across iOS and Android,” Calif researchers claimed in a disclosure report dated September 8.
They tested the tool on several test phones, including Google Pixel 10a models and an iPhone 17e model.
Memory Corruption in WeChat’s VoIP Stack
The researchers found the RCE bug in WeChat in July using a combination of large language models (LLMs), including open-weight ones and closed-sourced models from US frontier labs.
They declined to reveal the models they used and did not provide any details on the vulnerability.
They only explained that the flaw is a memory corruption issue in WeChat's voice-over-IP (VoIP) stack that relies on the privileges WeChat trusted contacts have when communicating with another user of the app.
They said, however, that their WeChat account was initially banned after they reported the flaw to Tencent, the company behind WeChat.
The Chinese firm later confirmed that exploiting the vulnerability could allow an attacker to perform remote command execution, and provided patched versions of the app on Android (8.0.77) and iOS (8.0.76).
Meanwhile, Calif researchers developed exploits for vulnerable WeChat apps in two days and then integrated them to the WeWorm hacking tool, which they said took them an additional week to build.
WeWorm Hijacks Accounts via WeChat Calls
WeWorm provides the attacker with full control of the targeted WeChat account and allows the attacker to read and send messages, make calls and act on the victim's behalf.
“The victim does not need to answer the call or interact with their phone at all. Even if they do answer, they hear nothing, and the exploit still succeeds. Declining the call stops that attempt, but the attacker can simply try again later, for example, while the victim is asleep,” the researchers wrote.
While the exploit requires the attacker to be on the victim's friend list, this limitation is “not much of a barrier” as “an attacker can compromise one of your friends first and use their account to reach you,” they added.
Additionally, they said that chained with other Android and iOS bugs, WeWorm can lead to full control of the device.
“A worm at this scale used to be the kind of thing that took a larger team months. AI can already do most of the work here. Our team provided the judgment about what to target and how to test it safely,” Calif researchers concluded.
Image credits: tovovan / Mamun_Sheikh / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/wechat-zeroclick-worm-hijack/