AI-developed worm exploits WeChat voice-call vulnerability
Researchers at Calif used artificial intelligence to discover a vulnerability in WeChat's voice-calling system and developed a proof-of-concept worm that could spread across iOS and Android devices without user interaction. Tencent confirmed the flaw and deployed a fix; there is no evidence the vulnerability was exploited in the wild.
What happened
Calif, a Palo Alto-based cybersecurity company, used advanced artificial intelligence models to discover a vulnerability in WeChat's voice-calling system and developed a proof-of-concept worm named WeWorm that could exploit it. The researchers built WeWorm in approximately one week after identifying the flaw within two days using AI.
The worm could initiate calls to WeChat contacts without the victim needing to answer, click a link, or interact with their phone. Upon successful exploitation, the attack took full control of the targeted WeChat account and could use saved contacts to spread to other devices, creating a self-spreading worm capable of moving between iOS and Android devices.
Reported impact
WeChat has over 1.4 billion monthly active users. Vinh Nguyen, a former National Security Agency chief data scientist, told The New York Times that the worm's ability to spread exponentially could have allowed it to reach hundreds of millions of devices within hours.
Once a WeChat account was compromised, an attacker could read and send messages, make calls, and impersonate the owner. Additional vulnerabilities could potentially allow full control of the device itself.
Index analysis
Calif described WeWorm as the first known zero-click worm capable of spreading through WeChat calls across both iOS and Android platforms. The researchers said they used a combination of open-source and leading U.S. AI models but did not identify them specifically.
Governance controls
Tencent confirmed the flaw and stated it had implemented a fix after Calif contacted the company. The fix was deployed on servers and made live for all users without requiring an app update or user action.
Tencent said it had no evidence that the vulnerability was exploited or that any user was affected. Calif stated it had not unleashed the worm and published its findings to raise public awareness about AI-enabled security risks.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.