Security researchers have demonstrated a devastating cross-platform zero-click worm that propagates through WeChat phone calls on iOS and Android without requiring the recipient to answer.

The security landscape shifted slightly when researchers at Calif Research published details regarding WeWorm—characterized as the first automated, cross-platform mobile worm capable of leaping between iOS and Android devices via standard messaging application phone calls [1.1.4]. Unlike conventional malware campaigns that rely on phishing links, malicious attachments, or user interaction, this mechanism requires no tap, swipe, or answered call to compromise an application instance.

What Actually Happened?

The demonstration involved a tightly controlled chain using three distinct test devices: a Google Pixel 10a acting as initial attacker, an Apple iPhone 17e receiving the call, and a second Pixel 10a positioned as the subsequent target. When the first device dialed the second, the exploit executed while the target device was still ringing. The compromise took only seconds, granting the attacker full programmatic control over the victim's WeChat account environment.

Once the intermediate device fell, it instantly pivoted into an attacker role, placing an automated call to the third handset and repeating the cycle. The recipient did not need to pick up the call; even if they answered instinctively, audio output remained silent while the underlying memory corruption payload executed successfully. Declining an incoming call blocked that specific attempt, but attackers retain the capability to redial autonomously during vulnerable hours, such as when the target is asleep.

The Technical Mechanism and AI Assistance

At its core, the vulnerability resides within WeChat's proprietary Voice over IP (VoIP) connection handling stack [1.1.4]. When a device receives incoming call signaling data, the application processes raw network packets before any visual user interface notification or audio ring event finishes execution. A memory corruption flaw inside this parsing routine allowed attackers to achieve remote code execution (RCE) directly through the signaling channel.

What makes this disclosure unique is the engineering velocity behind it. According to the disclosure timeline released by the research team, an AI model assisted in discovering the core vulnerability and writing initial functional exploit primitives within a two-day window [1.1.4]. Constructing the complete cross-platform worm automation logic took an additional week. This rapid turnaround highlights how automated reasoning engines can compress weeks of manual binary auditing into hours.

The Danger of Implicit Trust Networks

A zero-click vulnerability over a calling channel is potent on its own, but the worm dynamic relies heavily on social graph architecture. The exploit required the calling device to already exist inside the target's authorized WeChat contact list. For an ordinary messaging platform, this requirement might sound like a major operational hurdle. However, once a single account falls, the barrier dissolves entirely.

Modern applications extend elevated trust privileges to known contacts—automating media handling, prioritizing message payloads, and routing notifications smoothly. WeWorm weaponized this trust layout. By hijacking account #1, the worm immediately gains access to a fresh list of verified peers, turning every friend into an involuntary vector for the next stage of propagation.

Mitigation, Defense, and Patch Status

Calif Research disclosed the flaw to Tencent through responsible channels in July. Tencent responded by pushing out client-side updates—specifically Android version 8.0.77 and iOS version 8.0.76—on August 21 [1.1.3]. Crucially, the remediation did not rely solely on waiting for users to update their apps; Tencent deployed server-side request filters that successfully neutralized the exploit vector globally by late August.

Users are still urged to maintain running instances on current software builds, but the immediate crisis was mitigated through rapid server-side filtering. No field exploitation of this specific vulnerability has been documented outside of controlled research parameters.

Security Takeaway

This research underscores a sobering reality for modern application security. As messaging giants expand into feature-rich "everything apps" handling complex media, VoIP, and mini-programs, their attack surface multiplies exponentially. When combined with modern AI-driven vulnerability discovery tools, sophisticated memory corruption bugs can be uncovered and weaponized at unprecedented speeds, making proactive server-side security architectures more vital than ever.

---

Sources & References

• [1.1.1] Security Boulevard — Using AI, Calif Creates Demo WeChat Exploit that Spreads Through Phone Calls — September 8, 2026.
• [1.1.2] Help Net Security — "Zero-click" WeChat worm could hijack accounts and spread via a single call — September 8, 2026.
• [1.1.3] The Hacker News — WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls — September 8, 2026.
• [1.1.4] Calif Research — WeWorm: The first zero-click worm to spread through WeChat calls across iOS and Android — September 8, 2026.
• [1.1.5] Cyber Insider — Zero-click worm spreads on iPhones and Android via WeChat calls — September 8, 2026.