Yu Xuan, founder of SlowMist: WeChat account theft is mostly due to abandoning mobile phone numbers and having account privileges revoked, or social engineering attacks using verification codes.
According to Odaily Planet Daily, Yu Xuan, founder of SlowMist, analyzed the "He Yi's WeChat account theft" incident, stating that the hacker likely seized control of the user's long-abandoned phone number, thereby taking over the identity infrastructure linked to WeChat. Another common risk is CAPTCHA social engineering attacks: after obtaining a user's leaked account password, hackers impersonate the user and request a 6-digit verification code from two of their frequently contacted WeChat friends, thus completing the account theft.
Yu Xian pointed out that the prerequisites for the attack include matching account passwords from leaked data and collecting information on the victim's frequently contacted friends in advance (even users who only interact in group chats). Attackers often choose to carry out their attacks late at night, which is common in OTC scams targeting cryptocurrency users.
He reminded users to be cautious when adding strangers as WeChat friends, to change their passwords promptly, and to pay attention to various risk warnings from WeChat.
