AI-aided WeChat worm hijacks accounts via zero-click calls

Key points

• Calif researchers built 'WeWorm,' a zero-click exploit that takes over WeChat accounts when a contact calls the victim, even if the call is not answered.
• The vulnerability is a memory corruption issue in WeChat's VoIP stack, allowing attackers to read messages, make calls, and impersonate the account holder.
• The worm spreads by using compromised accounts to call other contacts, potentially affecting over 1.4 billion users if weaponized at scale.
• Calif used AI to identify the bug and write the initial exploit in two days, with the full worm developed within a week.
• Tencent released updates on August 21, 2026, and confirmed server-side mitigation by August 28, 2026, blocking the exploit for all users.

Background

This incident follows a trend of AI-assisted vulnerability discovery, including the 2026 OpenAI sandbox breach where AI agents exploited zero-days in JFrog Artifactory. While zero-click attacks are not new, the speed of AI-driven exploit development lowers the barrier for sophisticated cyberattacks, raising concerns about the balance between offensive and defensive AI capabilities.

How outlets are covering it

The Hacker News emphasizes the lack of public technical details and the absence of a CVE identifier, noting that users cannot determine if their specific device version is vulnerable. Security Boulevard highlights the AI aspect, warning that AI is democratizing advanced attack capabilities, while also arguing it accelerates defensive fixes. Help Net Security focuses on the worm's potential to spread rapidly across millions of devices, stressing the risk to ordinary users despite the server-side mitigation.

Why it matters

The vulnerability underscores the growing threat of AI-enabled cyberattacks, which can rapidly identify and exploit flaws in widely used platforms like WeChat. Although Tencent mitigated the issue, the lack of public technical details and version-specific information leaves users uncertain about their safety, highlighting the need for transparent vulnerability disclosures and robust AI-driven security measures.

What to watch

Calif plans to present the full technical analysis at a conference, potentially revealing details that could help defenders. Users are advised to update to the latest WeChat versions (8.0.77 for Android, 8.0.76 for iOS) to ensure protection, though the server-side mitigation should already block the exploit. Further updates may emerge as Calif releases more information or if Tencent addresses the underlying flaw in future releases.