Cybersecurity researchers have built a self-spreading computer worm named WeWorm that could take complete control of WeChat accounts across Android and iOS through an incoming phone call. Developed by researchers at Palo Alto-based cybersecurity firm Calif with assistance from artificial intelligence, the exploit required zero clicks, meaning a target did not have to answer the call or touch their phone for the attack to succeed. Once an account was compromised, the worm used the victim’s contact list to place automated calls to other friends, creating a chain reaction capable of hitting hundreds of millions of devices. Tencent, the Chinese technology firm that owns WeChat, addressed the issue after Calif reported the flaw in July.
Key Takeaways
- Researchers created a zero-click worm that takes over WeChat accounts through an unanswered call.
- Calif researchers used AI models to locate the flaw in two days and finished building the worm in one week.
- The bug allowed attackers to read messages, place outgoing calls, and take full control of the account.
- Tencent patched the flaw across Android and iOS versions and applied server-side blocks.
- The attack demonstrated how software that once required large technical teams and months to code can now be crafted in days using AI tools.
How the WeWorm Attack Operates
WeChat serves over 1.4 billion active users worldwide, handling messaging, digital payments, and everyday utility services. The vulnerability stemmed from a memory corruption flaw within WeChat’s voice-over-IP (VoIP) software stack. When an attacker placed an app call to a user, malicious code executed during the ringing phase.
Calif demonstrated the technique across three devices: an Android phone called an iPhone, compromising the device while it was still ringing. The hijacked iPhone then placed a call to a second Android phone, continuing the infection chain without user interaction. Answering the call did not prevent the exploit, as the audio channel stayed silent while the background code ran. While actively declining the call immediately stopped that specific attempt, an attacker could try again later when the target was away or asleep.
WeChat provides elevated permissions to people saved in a user’s contact book. Because the worm spread through existing friend connections, it bypassed standard incoming message warnings.
AI Accelerated Vulnerability Research
Creating functional zero-click exploits historically required specialized offensive engineering teams and months of reverse engineering. Calif researchers stated they used a mix of commercial and open-source AI models to scan the code base, identifying the flaw and producing the initial remote code execution exploit in roughly 48 hours.
Tencent released updated software versions 8.0.76 for iOS and 8.0.77 for Android in August, along with server-side mitigations to block malicious packets. The company confirmed it saw no signs of active exploitation in the wild.
Frequently Asked Questions
Q1. What is WeWorm?
A1. WeWorm is a proof-of-concept computer worm created by cybersecurity firm Calif that spread between WeChat accounts using unanswered phone calls.
Q2. Did WeChat users need to answer the call to get infected?
A2. No, the exploit was zero-click, which allowed the malicious payload to run while the phone was ringing.
Q3. Has Tencent fixed the WeChat vulnerability?
A3. Yes, Tencent rolled out client app updates in August and enabled server-side protections to prevent the exploit from working.
