AI-Assisted WeChat Worm Enables Zero-Click Account Hijacking

Researchers at the cybersecurity startup Calif have developed a new zero-click worm, named WeWorm, that is capable of hijacking WeChat accounts on both Android and iOS devices through incoming VoIP calls.

The tool exploits a memory corruption vulnerability within WeChat’s voice-over-IP (VoIP) stack. Because the exploit is zero-click, a victim does not need to answer the call for the attack to succeed. While declining an incoming call may stop a specific attempt, the attacker can simply retry later. Even if the user answers the call, they will hear nothing, and the exploit can still be successfully executed.

AI-Accelerated Exploitation

The discovery and development of the tool were significantly aided by artificial intelligence. Calif researchers reported using a combination of open-weight and closed-source large language models (LLMs) to identify the remote code execution (RCE) vulnerability. The researchers noted that AI performed much of the technical work, allowing the team to develop the exploits in just two days and integrate them into the WeWorm tool within a week.

Account and Device Hijacking

Once successful, WeWorm grants an attacker full control over the victim’s WeChat account. This enables the perpetrator to read and send messages, make calls, and perform actions on the user’s behalf. If the WeChat exploit is chained with other vulnerabilities within the Android or iOS operating systems, it could potentially lead to total control over the mobile device.

The attack currently requires the perpetrator to be included in the victim’s WeChat contact list. However, researchers warned that this is not a significant barrier, as an attacker can compromise one contact to gain access to another person in the victim’s network.

Mitigation and Patches

Tencent, the developer of WeChat, has confirmed the vulnerability and released security updates to address the flaw. To mitigate the risk, users should ensure they are running the latest versions of the application, specifically WeChat version 8.0.77 on Android or version 8.0.76 on iOS.