From Calif · · 2m
A WeChat worm that spreads by ringing you
Security researchers built a worm that hijacks WeChat accounts through a call the victim never has to answer.
In brief
Security researchers built a worm that hijacks WeChat accounts through a call the victim never has to answer. The bug is patched, but the real shift is speed: an AI-assisted team built a billion-user worm in nine days, so defenders have to move at that pace too. Originally reported by Calif.
A worm that travels by call
Calif released WeWorm, a zero-click worm that jumps between iOS and Android through WeChat's calling feature. Call someone, take their account, use it to call the next person.
“The first zero-click worm to spread through WeChat calls across iOS and Android.”
Why WeChat is the target
WeChat is the everything app for most of China and for Chinese communities abroad. One working exploit puts more than a billion phones and accounts in reach.
Three phones, one chain
A Pixel 10a called an iPhone 17e and owned its WeChat while the phone was still ringing. The iPhone then called a second Pixel and took that one too.
“Attacker calls victim, victim becomes attacker, victim calls the next victim.”
You never have to touch it
The victim does not answer, tap, or hear anything. Declining stops that one attempt, so the attacker just calls again while you sleep.
“Even if they do answer, they hear nothing, and the exploit still succeeds.”
Your friend list is the door
The attacker has to be a contact first, which sounds like a wall but isn't. They compromise one friend, then ride that trust straight to you.
“But once one contact is compromised, that trust works against you.”
Full run of your account
Seconds after the call lands, they can read and send messages, place calls, and act as you. Chained with reported Android and iOS bugs, it reaches the whole device.
Two days to an exploit
Working with AI, the team found the bug and wrote the first remote code execution exploit in about two days. The full worm took one more week.
“A worm at this scale used to be the kind of thing that took a larger team months.”
The skill floor just dropped
Well-funded actors have had this power for years. What changed is that weaker attackers can now buy in, and one leaked half-finished tool is all it takes.
“WannaCry got out that way, from tooling that escaped early and hit hospitals.”
Don't blame the AI
Calif argues the bugs were always there. AI is what lets people find and fix them fast, and they bet there are more good guys than bad ones paying attention.
“AI gives the good guys the upper hand.”
Reported in July, fixed by August
Calif told Tencent on July 24. Tencent shipped patched builds on August 21 and killed the exploit server-side for everyone by August 28. Technical details come later, at a conference.
In short
The bug is patched, but the real shift is speed: an AI-assisted team built a billion-user worm in nine days, so defenders have to move at that pace too.
