AI-powered 'WeWorm' exploits WeChat VoIP bug to hijack accounts via zero-click calls
Security researchers demonstrate a cross-platform worm that spreads through trusted social graphs without requiring user interaction.
Security firm Calif has developed "WeWorm," a proof-of-concept worm capable of hijacking WeChat accounts through a zero-click vulnerability. The exploit targets a memory-corruption bug in WeChat's VoIP stack to achieve remote code execution (RCE), allowing the worm to spread automatically across both iOS and Android devices.
The attack is particularly potent because it requires no interaction from the victim. By placing a VoIP call to a contact, the worm compromises the target's account while the phone is still ringing, before the user ever answers. In demonstrations, Calif showed the worm spreading from a Pixel 10a (Android) to an iPhone 17e (iOS) and then back to another Pixel 10a. While the initial attacker must be on the victim's friend list, this restriction is effectively bypassed once the worm compromises a single trusted contact, allowing it to traverse a user's entire social graph.
The Role of AI in Exploit Development
The creation of WeWorm highlights a significant shift in the speed of vulnerability research. According to Calif, AI tools were used to discover the memory-corruption bug and write the initial RCE exploit in approximately two days. The complete, functional worm was finished in just one additional week. This drastic reduction in development time suggests that the barrier to entry for creating sophisticated, planetary-scale mobile malware is lowering.
Industry Implications
This research underscores the danger of weaponizing trusted social networks. Because WeChat functions as an "everything app" with over 1.4 billion monthly active users as of Q1 2026, a successful worm could potentially compromise millions of devices with extreme rapidity. By utilizing zero-click VoIP vulnerabilities, attackers can turn a user's trust in their friends into a primary attack vector. "What's different now is that AI is putting these capabilities in the hands of less skilled actors, leaving ordinary users at unprecedented risk," Calif Research stated.
Current Status
Tencent has since mitigated the vulnerability server-side for all users, neutralizing the specific path used by WeWorm. However, the incident serves as a warning for other major messaging platforms that rely on complex VoIP stacks. Security experts will continue to monitor whether similar AI-assisted techniques are applied to other cross-platform communication tools to create similar zero-click propagation mechanisms.