Foreign Media Exposes Security Vulnerability in Kimi Desktop: Trojan Horse Could Be Installed on Users' Computers via Update Link

Dynamic Beating AI News Update, RuntimeWire Reverse Engineers Kimi Desktop and discovers that both the 3.1.5 and 3.1.10 Windows versions automatically download a standalone program `kimiim-cli` related to the group chat feature. However, before installation, the client neither checks if the file has been tampered with nor verifies if the program is signed by the Dark Side of the Moon.

This program fetches the latest version from the Dark Side of the Moon CDN. If the associated release account or update path is compromised, an attacker could replace the legitimate program with malicious code, which Kimi Desktop could still install on users' computers through the regular update process without requiring access to the Dark Side of the Moon's code signing key.

Currently, the kimiim-cli on the CDN itself carries a valid Dark Side of the Moon digital signature, and there is no evidence to indicate that this issue has been actively exploited. The problem lies in the fact that Kimi Desktop does not enforce signature verification before installation. RuntimeWire claims to have disclosed the issue to the Dark Side of the Moon in advance but had not received a response at the time of publication.