📱 Your phone can be hacked by a single call without you even answering
Most people believe that ignoring unknown numbers keeps them safe. The WeWorm attack proved the opposite: just an incoming call was enough to turn a smartphone into the next link in a digital infection chain.
🪱 A worm that spreads itself
Researchers at Calif built WeWorm as a laboratory zero-click worm targeting WeChat, the messaging giant whose ecosystem reaches 1.44 billion monthly users across Weixin and WeChat. Even without answering the call, the victim's account was taken over, and then the compromised account automatically started calling its own contacts to repeat the attack. The demonstration worked between Android and iOS devices with zero interaction from the owners.
🔴 Where the flaw lives
At the heart of WeWorm sits a memory corruption bug in the VoIP stack of WeChat, the component that handles voice calls. There is one catch: the attacker must already be in the victim's friends list. But after the first compromise, that condition stops mattering, because the hijacked account can call its trusted contacts and continue the chain on its own.
In the test, a Pixel 10a called an iPhone 17e and gained control of WeChat while the phone was still ringing. The captured iPhone then called a second Pixel 10a and repeated the whole process. The entire exploit took mere seconds.
Answering the call did not save the device, and rejecting it only stopped that specific attempt, since the attacker could simply ring again.
🦈 What the attacker actually gets
The exploit hands over full control of the WeChat account: reading and sending messages, making calls, acting on behalf of the owner. WeWorm alone does not seize the entire phone, though Calif sees full device takeover as a plausible scenario if chained with other Android or iOS bugs, something never confirmed in the demo.
🤖 AI accelerated everything
Neural networks played a starring role here. Calif says AI helped uncover the flaw, the remote code execution exploit was ready in about two days, and a full working worm took roughly another week. The team learned of the issue on July 23 and had the cross-platform demonstration done by August 11.
🛡 Patched, but lessons remain
Tencent got word on July 24. Versions 8.0.77 for Android and 8.0.76 for iOS, released on August 21, neutralize the attack, and by August 28 Calif confirmed a server-side block covering all users. So far, there are no signs of WeWorm spreading in the wild.
And that is the uncomfortable part. Attacks like this ignore old habits: it does not matter whether you pick up or not. Keep WeChat updated at all times, install updates the day they ship, think twice before adding unfamiliar contacts to your list, and turn on any extra account protection the app offers. Silence is no longer a defense.
😊 Follow us to stay informed about the latest threats and protect yourself.
#Cybersecurity #ZeroClick #WeChat #MobileThreats #AIHacking
@PrivacyNotACrime 🗽 ⌨️ Chat