[Foreign Media Exposes Security Risks in Kimi Desktop: If the Update Chain is Hacked, Malware Could Be Installed on User Computers as an Update] Beating AI Newsflash, RuntimeWire reverse-engineered Kimi Desktop and discovered that versions 3.1.5 and 3.1.10 for Windows automatically download a standalone program `kimiim-cli` related to group chat functionality. However, before installation, the client neither checks whether the file has been tampered with nor verifies if the program is signed by Moonshadow. This program fetches the latest version through Moonshadow's CDN. If the associated release account or update chain is compromised, attackers could replace the legitimate program with malicious code, and Kimi Desktop might still install it on user computers as part of the normal update process, without requiring Moonshadow's code signing key. Currently, the `kimiim-cli` on the CDN carries a valid Moonshadow digital signature, and there is no evidence that this issue has been exploited in practice. The problem lies in the fact that Kimi Desktop does not enforce signature verification before installation. RuntimeWire stated that it has disclosed the issue to Moonshadow in advance, but as of the time of publication, no response has been received. [Original Link]