There is a vulnerability in Kik Messenger for Android that
allows an attacker to send arbitrary XMPP stanzas (XMPP control
messages) to another Kik client, including XMPP stanzas that are
normally sent only by the Kik server. Included is a proof of
concept that demonstrates sending of the stc stanza which triggers
a captcha dialog and opens an arbitrary attacker-control webpage on
the victim client. However, the full impact is likely larger than
this, and includes any application features accessible over
XMPP.
