A missed WeChat call hijacks your account — AI wrote the exploit in two days

WeWorm is a zero-click worm — meaning it compromises a device with no action from the person holding it. The attack arrives as an incoming WeChat call. The target need not pick up; the exploit fires during the ringing phase, in the gap between the phone notifying the user and them declining or answering.

The vulnerability sits in WeChat’s VoIP stack, the code responsible for managing calls. A memory corruption flaw in that code let security researchers at Calif execute arbitrary commands on a remote device. Once active, the worm reads and sends messages, places calls, and impersonates the account owner — then dials that person’s contacts, repeating the chain.

What matters beyond the flaw itself is the speed. Working with AI, Calif’s team located the vulnerability and wrote the first working remote-code-execution exploit in roughly two days. Assembling the full worm took another week. That ten-day total from blank slate to deployable weapon would have been a significant achievement for a well-resourced team a few years ago. The researchers state that AI tools lower the floor for what a small team can develop, putting this class of work within reach of actors who would previously have lacked the expertise.

Recommended ReadingMeta’s smart glasses streamed intimate footage to Kenya — without telling you

The reach is large. WeChat has over one billion users, concentrated in China but present globally through Chinese-speaking communities and internationally installed base. In a lab demonstration, a compromised Android device infected an iPhone, which then infected a second Android. Working through contact lists — WeChat users typically have hundreds — the researchers estimate millions of devices could theoretically be reached within hours.

There are real limits. The attack requires the initial attacker to already appear in the target’s contact list, or to first compromise someone who does. The worm delivers control over the WeChat account, not the underlying phone — though Calif’s researchers note that chaining it with additional vulnerabilities achieved full device takeover in their lab tests. Tencent says it found no evidence the flaw was exploited in the wild before the patch arrived.

Tencent received Calif’s disclosure on July 24. Patched versions appeared on August 21 — Android 8.0.77 and iOS 8.0.76. A server-side mitigation confirmed on August 28 means users who have not updated remain protected at the network level. WeChat users on any current version carry no residual risk. No CVE number or formal Tencent security advisory has been published.

Calif plans fuller technical disclosure once industrywide mitigation advances, with a conference presentation expected. What the research makes concrete is the timeline: for this class of vulnerability in a widely used messaging app, an AI-assisted team converted discovery to deployable worm in roughly ten days.

Tags: Cybersecurity, AI security, Calif, Tencent, WeChat, zero-click exploit

More Like This

Supreme Court rules police need a proper warrant to pull your location from Google

A Supreme Court warrant ruling just became a problem for 113,000 police cameras

A scan of 380,000 vibe-coded apps found thousands with no authentication at all

An AI wrote a working zero-day exploit — Google caught it first

Your phone or router may have been one of 17 million devices secretly rented out

OpenAI’s hacking AI completes 95% of exploit chains — the standard model does 1.5%