AI-Built WeChat Worm Reveals Billion-Account Risk

How the Worm Spreads Across Both Phone Systems

WeWorm works by exploiting a flaw in WeChat's VoIP (voice-over-IP) system that requires no user action—victims don't need to answer a call or tap a link. IBTimes explains the worm hijacks an account through an incoming call, then automatically spreads to everyone in the victim's address book by making outgoing calls on both iPhones and Android phones. This cross-platform spread is novel: Calif said WeWorm is the first known worm to jump between Apple and Google operating systems entirely through a zero-click method. In demonstrations using a Google Pixel 10a attacking an Apple iPhone 17e, researchers showed how hundreds of millions of devices could be compromised within hours by chaining through address books.

1 source

AI Accelerates the Speed of Weaponizing Security Flaws

What sets WeWorm apart is how quickly it was built. Calif used a combination of open-source and leading U.S.-based AI models to identify the vulnerability and generate an initial working exploit in about two days, then completed the full worm roughly a week later. PC Tablet reports this compressed timeline illustrates a major cybersecurity concern: artificial intelligence can dramatically speed up the discovery, testing, and weaponization of zero-day vulnerabilities. Without AI, such work typically takes security teams weeks or months. Calif warned that widespread access to powerful AI models could enable attackers to find and exploit flaws faster than defenders can patch them.

The firm did not disclose which specific AI models were used, citing plans to share full technical details at an upcoming security conference. This partial disclosure is intentional—Calif balances transparency to warn the industry against revealing exploits that could be immediately adopted by criminal groups.

1 source

Tencent's Patch and Evidence of Real-World Attacks

Tencent moved quickly after Calif's private report. The company released patched versions of WeChat for both platforms within weeks and implemented server-side mitigations to block the exploit. UK PC Mag notes that Tencent said it found no evidence that actual users were compromised during the vulnerability window, and stated that no further action was required. However, Calif's disclosure raises questions about whether the flaw was discovered and exploited by threat actors before the patch dropped—security researchers often find evidence of exploitation only months or years after an attack begins.

1 source

What This Means for Billions of WeChat Users Worldwide

WeChat has 1.4 billion monthly active users, making it one of the world's most widely used messaging apps. A successful WeWorm attack could have given hackers read and send access to private conversations, voice calls, and payment information—all without the victim knowing they were compromised. Cyber Kendra reports the vulnerability affected both Android and iOS simultaneously, eliminating the possibility that users could simply switch phones to escape the worm. The disclosure highlights a critical gap: even massively popular apps with large security teams can miss critical flaws, and AI-powered discovery tools will only make such misses more consequential if wielded by attackers.

1 source