Researchers Build AI-Powered WeChat Worm That Spreads Through Calls

Security researchers at Palo Alto-based Calif say they applied AI tools to build a self-spreading worm capable of taking over WeChat accounts through incoming calls without requiring the victim to answer.

Key points

• The firm first learned concerning the vulnerability on July 23, completed an Android exploit on July 30, and had the demo worm ready by August 11.
• WeChat and its Chinese version, Weixin, had around 1.439 billion combined monthly active users as of June 30, according to Tencent.
• Add ProPakistani to Preferred Sources and see more of our stories in Google Search and Top Stories.
• Its researchers informed The New York Times that an initial exploit took concerning two days of active work, with another week spent developing the worm.
• The firm informed The New York Times it had no reason to believe the flaw had been exploited or had compromised any users.

For context, the researchers named the proof-of-concept WeWorm and described it as the first zero-click worm capable of spreading through WeChat calls on both Android and iOS. Tencent has confirmed the vulnerability and notes it has fixed the problem, with no evidence that users were affected. Attack Worked While the Phone Was Ringing.

Meanwhile, the attacker first needed to be on the victim's WeChat friend list.

From there, the attacker could place a call to the targeted account. Calif remarked the victim did not need to answer for the exploit to work. If successful, the attacker could gain control of the account and then employ it to call further contacts, allowing the worm to spread. Declining the call halted that individual attempt.

Calif remarked a compromised account could allow an attacker to read and send messages, produce calls, and act as the account owner.

For context, the firm attributed the vulnerability to a memory corruption flaw in WeChat's internet calling system. Google AI Intends Secure 4 New Free Features. AI Supported Researchers Develop the Exploit.

Calif remarked AI played a major role in finding the vulnerability and developing the exploit.

Nevertheless, Calif's published timeline covers a longer period. The firm first learned concerning the vulnerability on July 23, completed an Android exploit on July 30, and had the demo worm ready by August 11.

Calif remarked human researchers still needed to closely supervise the AI throughout the process.

Meanwhile, the firm employed a mixture of open-source and major US AI models but did not disclose which specific models were involved. Tencent Notes the Vulnerability Is Fixed. Tencent confirmed the vulnerability after Calif documented it on July 24.

According to Calif, Tencent afterwards issued WeChat 8.0.77 for Android and 8.0.76 for iOS on August 21 before introducing a server-side block for all users on August 28.

According to Tencent subsequently, the vulnerability could allow remote command execution, according to Calif.

For context, the firm informed The New York Times it had no reason to believe the flaw had been exploited or had compromised any users. Tencent additionally stated users did not need to manually update the app since it had implemented protections on its side.

No CVE identifier or detailed public security advisory has been issued for the vulnerability. WhatsApp Plus Paid Subscription Details Made public. Potential Reach Was Significant.

That scale created the vulnerability particularly concerning as WeChat accounts are commonly connected to messaging, payments, official accounts and mini programs.

Calif has not published the technical details required to reproduce the exploit, and there are at present no reports of WeWorm being applied in a real-world attack.

For context, the firm stated the project is part of a broader series of research into messaging applications, with a more detailed technical analysis projected to be presented afterwards. Stay Connected with ProPakistani.

Obtain the latest tech news, telecom insights, and product launches wherever you prefer. Follow on Google Discover.

Add as a preferredSource on Google Follow on Google News Join WhatsApp.

Technology and Automotive Specialist covering the latest cars, smartphones, AI breakthroughs, and.

Taken together, the developments around researchers Build AI-Powered WeChat Worm That Spreads Through Calls point to a situation that is still moving, and the coming days should bring more clarity.