Police apprehend WeChat account hijackers

Ti Gong

Thirteen people have been caught for allegedly using software to gain control of WeChat accounts in order to feed scams, Shanghai police said on Thursday.

The suspects allegedly developed and sold a software called Hanghaiwang over the Internet for that purpose and raked in about 1 million yuan (US$143,000) from the operation.

Police in Huangpu District said they started their investigation together with Tencent, the developer of WeChat, in May after they discovered that suspects in an Internet scam were using software to spoof IP addresses when logging onto WeChat.

Police found that they had purchased and rented WeChat accounts from the Internet and used Hanghaiwang to control them from one master account. The software allegedly enabled them to log onto a large number of WeChat accounts and create posts for the accounts’ contacts to see.

The WeChat accounts accessed in this way were previously active in different parts of the country, but scammers used the software to disguise their location in order to evade being blocked by Tencent, police said.

Eleven suspects who allegedly developed Hanghaiwang and sold it to others were caught in Chongqing, Beijing, Zhengzhou and Qingdao in June, while two others were caught later.

The suspects could face criminal charges of providing programs or tools for hacking into computer systems, in this case the computer system of Tencent, police said.

Underground industry

One suspect in this case, a man surnamed Wu, allegedly provided the rest with “technology related to WeChat” that enabled them to develop the software. Police said Wu was not an employee of Tencent, but they’re still investigating how he obtained this technology.

Zhao Wenjun, a security expert working for Tencent, said the suspects could somehow decode it from the WeChat app.

“We strive to ensure that the users’ accounts are not rigged by a third party, but the struggle with criminals who try to break into the closed loop is never ending,” Zhao said.

Zhao said that criminals can rig the system by getting the verification information of WeChat users, through a variety of means which users are either aware or unaware of.

Account hijacking software is mostly sold to scammers who use illegal methods to control a large number of WeChat accounts, police said.

“In some cases, some people share their accounts with people who promise to attract more followers for them,” said Zhuang Liqiang, a spokesman for Shanghai police.

Zhang Yu, the police officer from Huangpu District in charge of the case, said one account with the illegal software controled hundreds of WeChat accounts and could send an indefinite number of WeChat messages and posts every day as long as the anomaly went unnoticed by Tencent.

How can you better protect your WeChat account? Here are some tips from Zhao, the security expert from Tencent:

• Don’t lend your account to strangers who offer to increase your game levels or promise to help you make money if you share your WeChat pay. Those people could share your key account information with scammers.
• Don’t lend your account to a person you think you know if he or she asks, without contacting that person in order to prove their identity. That person’s account could be hacked already.
• Don’t click on unknown links or QR codes sent to you on WeChat, even if they are sent to you by people you know. Their accounts could be hacked already. By clicking on them, you could leak key account information to the hackers. Criminals can hijack your accounts by sending you scam messages or sending scam messages to your friends without your notice. In this case, the account security of your friends could also be compromised.