AI-Powered Tool Lets Hackers Hijack Millions of WeChat Accounts

A small team of researchers at Calif, a Palo Alto-based security firm, assembled an artificial-intelligence-driven hacking utility in just over a week. The software exploits a vulnerability in WeChat, the dominant Chinese messaging platform, allowing an attacker to seize control of a user’s phone number, read private messages, and impersonate the victim to contact saved contacts. Within hours of deployment, the tool propagated across the network, compromising the accounts of millions of users and enabling a cascade of further intrusions.

New York Times

The rapid creation of the exploit reflects a broader shift in cyber-threat capabilities, where advanced AI models accelerate the discovery and weaponization of software bugs. WeChat’s near-ubiquitous presence in China—serving as both a social media outlet and a primary communication channel for businesses and individuals—makes it an especially lucrative target. A year ago, such a large-scale, AI-facilitated breach would have seemed plausible only for nation-state actors; the new tool demonstrates that relatively modest teams can now achieve comparable impact.

New York Times

Calif’s chief executive, Thai Duong, described the discovered flaw as “exceptional” and noted that its simplicity and power would be “a dream come true” for malicious actors. He emphasized that Calif builds hacking tools not for commercial sale but to expose weaknesses and strengthen cyber-defense measures. The company has not disclosed whether it plans to release patches or coordinate remediation with WeChat’s operators.

New York Times

The attack’s speed and breadth resulted in the compromise of millions of WeChat accounts. Victims reported loss of control over their phone numbers, unauthorized access to private conversations, and the use of their contacts for further phishing attempts. The rapid spread mirrors the behavior of a highly contagious virus, underscoring the tool’s efficiency.

New York Times

The incident illustrates how AI lowers the barrier to developing sophisticated exploits, blurring the line between state-level capabilities and those of small private teams. It raises urgent questions about the preparedness of platforms like WeChat to detect and mitigate AI-enhanced threats, and it signals a need for heightened vigilance across the global digital ecosystem as similar tools could be adapted for other services.

New York Times