A 'Zero-Click' WeChat Worm Shows How AI Is Turning Phone Calls Into Attack Vectors

On September 8, security coverage detailed WeWorm, a zero-click, AI-assisted worm built by the Palo Alto security firm Calif that hijacks WeChat accounts on iOS and Android through a single incoming call. The researchers discovered the underlying flaw, wrote a working exploit, privately reported it to Tencent, and then went public with the story to argue that artificial intelligence is putting state-level hacking capabilities within reach of far less skilled actors.

WeChat is not an ordinary messenger. It is a Chinese super app that bundles text, voice and video messaging with mobile payments, shopping, ride-hailing, food delivery, government services and social media, and it is used by more than a billion people, overwhelmingly in China. That scale makes account takeover unusually consequential: an attacker who controls a WeChat account can reach a victim's money, contacts and a large share of their daily digital life, and a worm that spreads through contact lists can multiply without any further effort from the attacker.

Key Facts

Help Net Security reported on September 8 that the worm spreads whether or not the victim answers the call, that exploitation takes only seconds, and that it gives full control of the WeChat account, including the ability to read and send messages, make calls and act on the victim's behalf. The publication noted that the attack fails only if the victim declines the call within a few seconds, and that an attacker can simply call again when the target is asleep or otherwise unable to decline.

Help Net Security reported on September 8 that, working with AI, the Calif team found the bug and wrote the first remote-code-execution exploit in about two days, and that building the worm took one more week. The researchers confirmed the underlying issue is a memory-corruption problem in WeChat's VoIP stack, but they are keeping the technical details under wraps so that users have time to update.

Help Net Security reported on September 8 that WeChat is used by more than a billion people, overwhelmingly based in China, and that the worm can hop from smartphone to smartphone regardless of whether they run iOS or Android. Chained with other Android and iOS bugs the team has reported and is helping fix, the researchers said the access can lead to full control of the device.

The New York Times reported on September 8 that experts said the exploit could have infected hundreds of millions of devices within hours if it had been unleashed. The same reporting underscored that the worm required no action from the victim beyond receiving a call, which is why the researchers described the attack as zero-click.

Help Net Security reported on September 8 that Tencent mitigated the bug by issuing new versions of the WeChat app for iOS and Android, and later mitigated the exploit for all users on the server side. Because of that server-side fix, users did not need to take any action to keep their accounts and smartphones protected.

Analysis

What this really means is that artificial intelligence has compressed the timeline for turning a subtle software flaw into a self-spreading weapon. The researchers described the feat plainly: with AI assistance, the team found the bug and wrote the first remote-code-execution exploit in about two days, and the worm took one more week. Measured against the history of memory-corruption research, where finding a bug of this class and writing a reliable exploit often consumed months for skilled human teams, that pace is a step change, and it is the pace that the security industry now has to defend against.

The bigger picture here is that the phone call, long treated as the most trusted and least technical channel, has become a potential remote shell into a super app. Zero-click matters because it removes the human error that most security advice depends on: the victim does not need to click a link, open an attachment or enter a password. The only partial defense described in the coverage is declining the call within seconds, and an attacker can simply call back later, which is not a strategy that protects a billion users.

Read against the history of computer worms, WeWorm looks like a mobile-era echo of the self-propagating worms of the early internet, which spread by exploiting network services without user action. What is new is the substrate: a messaging and payments app that concentrates identity, money and the social graph in one place, plus an AI copilot that collapsed the development time. The researchers themselves said these capabilities have existed for a long time in the hands of well-funded, sophisticated actors, and that AI is now putting them in the hands of less skilled actors.

It is worth stressing how the AI angle changes the economics of defense as well as attack. In the past, a flaw like this might have been discovered by a state-sponsored team with no incentive to disclose it, which could leave the vulnerability sitting silently for a long time. Here, a commercial research firm used the same AI acceleration to find it, report it to the vendor and get it patched in a matter of weeks. That suggests the new tools are a double-edged sword: they lower the floor for attackers, but they also compress the window between discovery and disclosure for defenders who are willing to publish.

Why It Matters

The stakes follow from WeChat's role in everyday life. With more than a billion users, overwhelmingly in China, the app is where people talk to family, pay merchants, book rides, order food and reach government services. An account takeover is therefore not merely a privacy breach; it can expose payment methods and impersonate the victim to everyone they know. A worm that propagates through saved contacts compounds the damage, because each new victim becomes a launchpad for the next wave of calls.

The New York Times reporting that the exploit could have infected hundreds of millions of devices within hours if unleashed is the number that should give the industry pause. That estimate describes the ceiling of the damage, and the fact that the demonstration stopped at the research stage is the difference between a headline and a global incident. It also explains why the researchers chose to publish only after Tencent shipped fixes, and why they are withholding the technical details.

The demonstration also carries a warning for every company that ships a VoIP or messaging stack. The vulnerable component, described as a memory-corruption issue in WeChat's VoIP stack, is not exotic; voice-calling code has a long history of parsing errors and memory-safety bugs. If an AI-assisted team could find and weaponize one in a matter of days inside a heavily audited super app, comparable code in smaller applications is at least as exposed.

Finally, the episode is a test case for disclosure norms. Calif reported the flaw privately to Tencent, waited for patches, and only then published. That sequence gave the vendor time to respond and users a path to safety, and it is the kind of coordinated disclosure that the security community has spent years trying to standardize, even as the underlying capability grows more dangerous.

Next Up

Tencent's response already covers all WeChat users: new versions for iOS and Android, followed by a server-side fix that protects accounts without any action from the user. The next question is whether the underlying class of bug gets broader attention, since the technique that found it in WeChat's VoIP stack can be aimed at other messaging, calling and conferencing software that depends on the same kind of call-handling code.

Calif says it is helping fix the chained Android and iOS bugs that could escalate a WeChat account compromise into full device control, and it is urging governments to work with the private sector on developing and deploying AI to make the world safer rather than only more exploitable. For the rest of the industry, the lesson is straightforward: assume that VoIP and messaging parsers are being probed by AI-assisted researchers and attackers alike, and treat memory safety in call-handling code as critical infrastructure rather than an afterthought.