A team of researchers at Calif, a cybersecurity startup based in Palo Alto, California, has built a tool capable of hacking Android and iOS phones via a simple incoming call.
The hacking tool, dubbed WeWorm, relies on the exploitation of remote code execution (RCE) vulnerabilities in WeChat, a Chinese super-app that allows users to exchange messages, calls, make purchases, place transactions and more.
It is “the first zero-click worm to spread through WeChat calls across iOS and Android,” Calif researchers claimed in a disclosure report dated September 8.
They tested the tool on several test phones, including Google Pixel 10a models and an iPhone 17e model.
Memory Corruption in WeChat’s VoIP Stack
The researchers found the RCE bug in WeChat in July using a combination of large language models (LLMs), including open-weight ones and closed-sourced models from US frontier labs.
They declined to reveal the models they used and did not provide any details on the vulnerability.
They only explained that the flaw is a memory corruption issue in WeChat's voice-over-IP (VoIP) stack that relies on the privileges WeChat trusted contacts have when communicating with another user of the app.
They said, however, that their WeChat account was initially banned after they reported the flaw to Tencent, the company behind WeChat.
The Chinese firm later confirmed that exploiting the vulnerability could allow an attacker to perform remote command execution, and provided patched versions of the app on Android (8.0.77) and iOS (8.0.76).
Meanwhile, Calif researchers developed exploits for vulnerable WeChat apps in two days and then integrated them to the WeWorm hacking tool, which they said took them an additional week to build.
WeWorm Hijacks Accounts via WeChat Calls
WeWorm provides the attacker with full control of the targeted WeChat account and allows the attacker to read and send messages, make calls and act on the victim's behalf.
“The victim does not need to answer the call or interact with their phone at all. Even if they do answer, they hear nothing, and the exploit still succeeds. Declining the call stops that attempt, but the attacker can simply try again later, for example, while the victim is asleep,” the researchers wrote.
While the exploit requires the attacker to be on the victim's friend list, this limitation is “not much of a barrier” as “an attacker can compromise one of your friends first and use their account to reach you,” they added.
Additionally, they said that chained with other Android and iOS bugs, WeWorm can lead to full control of the device.
“A worm at this scale used to be the kind of thing that took a larger team months. AI can already do most of the work here. Our team provided the judgment about what to target and how to test it safely,” Calif researchers concluded.
Image credits: tovovan / Mamun_Sheikh / Shutterstock.com