WeWorm – First 0

Cybersecuritynews •Guru Baran • September 8, 2026

A proof-of-concept zero-click worm dubbed “WeWorm” that it says can spread through WeChat voice calls on both iOS and Android, compromising a target’s WeChat account in seconds without the victim answering the call. Calif says the bug was reported to Tencent in July and that Tencent has since mitigated the exploit for users, but the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI-Driven WeChat Worm Threatens Over 1 Billion Accounts Researchers at Calif developed WeWorm, a zero-click computer worm exploiting a memory corruption vulnerability in WeChat's VoIP stack. This worm can hijack WeChat accounts through incoming calls without requiring any interaction from the victim, potentially affecting over 1.4 billion users. The attack method allows the worm to spread by calling users on the victim's contact list, creating a self-replicating threat. Calif reported the vulnerability to Tencent in July, which subsequently patched the flaw in August 2026. No evidence of real-world exploitation has been found, but the rapid development of the worm—completed in just over a week with AI assistance—raises concerns about the accessibility of such capabilities to less-skilled attackers. The researchers emphasize the need for collaboration in using AI for cybersecurity defenses. Current versions of WeChat have mitigated the exploit, and users are advised to ensure they are running the latest updates. 19 sources 58

Extracted Entities

WeWorm – First 0

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Malware (1)

Platforms (2)