🚨WeWorm: Zero-Click Exploit Spreads via WeChat Calls
A billion phones at risk from a zero-click WeChat worm
TL;DR
A new zero-click worm, WeWorm, can spread through WeChat calls, hijacking accounts and compromising over a billion phones. The exploit requires the attacker to be on the victim's friend list and takes seconds to execute.
WeWorm, a groundbreaking zero-click worm, can spread through WeChat calls, hijacking accounts and compromising over a billion phones. The exploit, which requires the attacker to be on the victim's friend list, takes only seconds to execute, giving full control of the WeChat account. This is a massive security risk for WeChat users, especially those in China and Chinese communities worldwide. The bug was discovered by AI and reported to Tencent in July 2026, with mitigations rolled out by August 21, 2026. The exploit highlights the vulnerability of VoIP stacks and the importance of robust security measures in widely used apps.
Key Points
WeWorm can hijack WeChat accounts and spread to friends' phones, compromising over a billion devices.
The exploit requires the attacker to be on the victim's friend list and takes only seconds to execute.
The bug was discovered by AI and reported to Tencent on July 24, 2026.
Tencent released updates (Android 8.0.77, iOS 8.0.76) on August 21, 2026, to mitigate the vulnerability.
The exploit was confirmed to be mitigated for all users on August 28, 2026.
Why It Matters
If you're using WeChat, especially in China, this exploit highlights the importance of account security. The zero-click nature of WeWorm means it can spread silently, compromising accounts and potentially disrupting livelihoods and communities. The quick response from Tencent to mitigate the issue is commendable, but it underscores the need for continuous security vigilance in widely used apps.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,484 builders reading daily.