WeCom says a hacked third-party add-on made business accounts send porn spam; affected accounts forced offline
On Oct. 24, WeCom accounts tied to several brands were seen sending suspected porn-spam links to customers. The WeCom security team said a third-party add-on service had been compromised, hitting accounts that used it. It forced those accounts offline, blocked the links, and said it will keep removing multi-login and bulk-control tools and penalize users.
Why it matters
Many businesses plug unofficial automation tools into WeCom; once one is breached, attackers can message customers under trusted brand accounts, a reminder to audit third-party add-ons that touch account and customer data.
Sources2
Written by dalao.ai: the title, summary and why it matters are our own words. The original reports are the record; their publishers keep authorship.