WeChat Worm Can Hijack Accounts Without Victims Answering Calls
Brief
Researchers built a WeChat worm that spreads through incoming calls without user action. Tencent has blocked the exploit.
Researchers at Calif created a WeChat worm that can take over an account through an incoming call, even if the victim never answers or touches the phone.
The attack works only when the caller already appears in the victim’s WeChat contacts. Calif reported the flaw to Tencent in July, and Tencent has blocked the exploit for all users. The good news is that researchers found no evidence that attackers used the flaw in real-world attacks, but the case shows how dangerous zero-click vulnerabilities can be.
“Simply by calling a victim, WeWorm can hijack their account and call their friends, spreading from phone to phone.” reads the report at Calif.