click" WeChat worm could hijack accounts and spread via a single call
Security researchers have discovered a critical 'zero-click' vulnerability in WeChat that allows attackers to hijack accounts and spread a worm via a single call. Tencent has since mitigated the flaw, but the incident highlights the risks associated with super-app architectures.
Why it matters
The vulnerability demonstrates how easily massive user bases can be compromised through automated exploits, posing significant privacy and security risks for global communication platforms.
“Zero-click” WeChat worm could hijack accounts and spread via a single call Researchers with security company Calif have discovered, weaponized, and privately reported to Tencent a critical vulnerability that allowed them to create “WeWorm”, a worm that spreads via WeChat calls without any user interaction.
During its rampage, the WeWorm compromises the WeChat account of each user, and uses the saved contacts to propagate itself further, potentially reaching millions of devices within hours.
The worm can hop from smartphone to smartphone, regardless of whether they are running iOS or Android, as shown in this demo :
“Simply by calling a victim, WeWorm can hijack their account and call their friends,” the researchers explained.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in