AI-Driven WeChat Worm Threatens Over 1 Billion Accounts

• •WeWorm can hijack WeChat accounts via missed calls without user interaction.
• •The vulnerability affects both iOS and Android versions of WeChat, impacting over 1.4 billion users.
• •Calif developed the exploit in just over a week, highlighting the speed at which AI can assist in creating cyber threats.

Researchers at Calif developed WeWorm, a zero-click computer worm exploiting a memory corruption vulnerability in WeChat's VoIP stack. This worm can hijack WeChat accounts through incoming calls without requiring any interaction from the victim, potentially affecting over 1.4 billion users. The attack method allows the worm to spread by calling users on the victim's contact list, creating a self-replicating threat. Calif reported the vulnerability to Tencent in July, which subsequently patched the flaw in August 2026. No evidence of real-world exploitation has been found, but the rapid development of the worm—completed in just over a week with AI assistance—raises concerns about the accessibility of such capabilities to less-skilled attackers. The researchers emphasize the need for collaboration in using AI for cybersecurity defenses. Current versions of WeChat have mitigated the exploit, and users are advised to ensure they are running the latest updates.