Researchers Build WeChat Worm Using AI
Security firm Calif claims to have utilized AI to uncover a vulnerability in WeChat’s calling feature and create a worm that takes over accounts before users even answer their phones. According to The New York Times, the worm, dubbed WeWorm, is the first zero-click worm to spread through WeChat calls on both iOS and Android.
The Attack Mechanism
The attack relies on an AI-driven process:
- AI Detection: AI models identify a memory corruption bug in WeChat’s internet calling stack.
- Exploit Development: With this knowledge, researchers swiftly develop an exploit within two days.
- Worm Creation: An additional week is spent building the worm, which can hijack accounts and replicate itself through contacts.
Impact and Mitigation
Tencent, the parent company of WeChat, has acknowledged the flaw and asserts that it has since been remedied. They claim no users were affected and have not released an official advisory.
The worm’s reach is concerning given WeChat’s immense user base: over 1.439 billion combined monthly users on June 30th, as per Tencent’s second-quarter results. With such a wide reach, many users rely on their WeChat accounts for more than just messaging—it also facilitates payments, official accounts, and mini programs.
How the Attack Works
- Friend List Requirement: The attacker must be on the victim’s friend list to initiate a call.
- Call Manipulation: Even if the recipient doesn’t answer, the exploit still proceeds. Declining the call stops immediate attempts but allows for future retries.
- Weak Friend List Condition: An attacker controlling one account can access all contacts trusted by that account due to WeChat’s contact sharing permissions.
AI’s Role
Calif’s CEO, Thai Duong, attributes the worm’s rapid development to "exceptional" bug discovery and AI assistance in navigating messaging app attack surfaces. They developed a set of skills for AI to traverse these complex landscapes, ultimately leading to this vulnerability.