AI Weekly Malaysia

Tencent patched security vulnerabilities in WeChat after US cybersecurity firm Calif demonstrated an AI-driven attack worm dubbed 'WeWorm' that could hijack accounts and spread autonomously. The demonstration showed how AI can be used to discover and exploit software weaknesses at scale, prompting WeChat to fix the flagged flaws.

Why: If you ship AI agents or LLM-powered tools, this is a concrete example of AI being weaponized to autonomously find and chain exploits — the same pattern could target your own APIs or agent endpoints. WeChat's massive user base in Malaysia and SEA means any builder integrating WeChat APIs or building on platforms with similar plugin/extension architectures should review their own input validation and privilege boundaries now, not wait for a CVE.

Security researchers at Calif discovered a zero-click worm in WeChat's VoIP stack that could hijack a user's account before they answered a call, then auto-call trusted contacts to spread. Tencent patched the flaw on August 21, but Calif withheld full exploit details. Calif reported using AI to find the vulnerability and develop a working RCE exploit in approximately two days.

Why: WeChat is widely used across Malaysia and SEA for business and personal communication; if your team or customers use it, confirm devices have updated to versions with Tencent's August 21 patch. The AI-assisted exploit development timeline (~2 days from bug discovery to RCE) is a concrete signal that AI-assisted vulnerability research is compressing the window between flaw and weaponization, which should factor into how fast you patch and how seriously you treat dependency and client-app update cycles.

Security firm Calif built a zero-click worm that takes over WeChat accounts via incoming calls—no answer required—demonstrating it spreading across three test phones (Android to iPhone to Android). The caller must be an existing WeChat contact, but once one contact is compromised, the trust WeChat grants contacts turns the worm self-propagating. Tencent patched the flaw in versions 8.0.77 (Android) and 8.0.76 (iOS) released 21 August, and confirmed server-side blocking on 28 August; no real-world attacks were reported.

Why: WeChat's 1.439 billion users include many in Malaysia and SEA who use it for payments, mini programs, and business with China—the exploit gave full account control (messages, calls, payments) without touching the phone OS. If you or your customers use WeChat for commerce, confirm devices are updated past 8.0.77/8.0.76 and treat contact-list trust as a propagation risk when designing social-graph-based features in your own apps.