AI helped build a WeChat worm that spreads through phone calls
Calif Research published WeWorm on September 8, 2026, a zero-click worm that takes over a WeChat account when an attacker already on the victim's friend list places a call. The victim never answers or touches the phone, and the worm then calls that person's contacts. Working with AI models, the team found the remote code execution flaw and wrote the first exploit in about two days, and building the worm took one more week. It works on iOS and Android, and Calif estimates the technique could compromise over a billion accounts. Tencent shipped patches on August 21 and Calif confirmed server-side blocking on August 28.