New WeWorm tool hacks Android and iOS phones via WeChat calls

A cybersecurity startup has developed a new hacking tool called WeWorm that can compromise Android and iOS phones through a simple incoming call on WeChat, as reported by Infosecurity Magazine.

The WeWorm tool exploits a zero-click remote code execution vulnerability in WeChat's voice-over-IP stack. Researchers from Calif discovered the flaw, a memory corruption issue, using a combination of large language models. The vulnerability allows an attacker, who must be on the victim's friend list, to gain full control of the targeted WeChat account without the victim needing to answer or interact with the call. Even declining the call does not prevent the exploit. When chained with other OS flaws, WeWorm can ultimately lead to full device control, the researchers said.

The vulnerability affects both Android and iOS versions of WeChat. Tencent, the company behind WeChat, has confirmed the vulnerability and released patched versions of the app. The researchers noted that AI can significantly speed up the development of such tools, reducing the time and resources needed to create sophisticated worms.

Source: Infosecurity Magazine