WECHAT IDENTITY API PWNED - HARDCODED TOKEN + MASS KYC BYPASS - ENUM ANY USER 2026
by Xxxxdxdxdxdddxxdxxdd - Monday April 20, 2026 at 05:46 PM
#11
谢谢您的分享!
Reply
#12
thanks bro
Reply
#13
Thank you bro!
Reply
#14
Thank you bro!
Reply
#15
Thank you.
Reply
#16
good one
Reply
#17
(20-04-26, 05:46 PM)xorcat Wrote: Hello DarkForums Community,

Today I have uploaded the WeChat Identity Verification API Exploit - Mass KYC bypass tool targeting Chinese identity verification service with complete identity matching capabilities.

Tool Info:
- Target: fws.xuanyanmeng.com (Identity Verification Service)
- Endpoint: /api/wechat/updataInfo + /api/wechat/xcx_register
- Method: POST with hardcoded API token
- Auth: NONE REQUIRED (exposed token)

Compromised Capability:
- Query any Name + WeChat ID combination
- Verify if real name matches WeChat account (KYC bypass)
- Mass enumeration without rate limiting
- Build database of real name → WeChat associations

How It Works:
1. Send POST request with person_name + wx_code (WeChat ID)
2. API responds with match/no-match based on account linkage
3. No authentication needed - token hardcoded in source

Exploitation:
- Input: Target's real name + WeChat ID guess
- Output: ✅ Match confirmed / ❌ No match
- Use case: Identity verification bypass, social engineering prep, KYC fraud

Download:

Files: https://t.me/+Lv3LYdpVyJc5ZTM0
Vouch center: https://t.me/+wuOFH81f2us1YmQ0
Website: https://xorcat.deals/
Reply
#18
good man
Reply
#19
thanks
Reply
#20
thanks a lot
Reply


Forum Jump:


 Users browsing this thread: