WeWorm: first zero-click worm spreads via WeChat calls across iOS and Android
jedisct1 · x · 2026-09-09
Security firm Calif demoed WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android, covered by the New York Times.
- Merely calling a victim lets the attacker hijack their WeChat account while the phone is still ringing — no answer or interaction needed; even answering shows nothing.
- A three-phone demo (Pixel 10a → iPhone 17e → Pixel 10a) shows worm-style propagation: each victim becomes the next attacker.
- Exploitation takes seconds, enabling reading/sending messages, calls, and impersonation; chained with other reported bugs it can yield full device control.
- Declining the call blocks that attempt but attackers can retry. Potential exposure spans over a billion phones/accounts.
Related event: WeWorm: Zero-Click Worm Hijacks Accounts via WeChat Calls(3 posts)→
More from Safety
- LLM bias judges name groups instead of saying 'unknown', refusing only 0.4% of the time — ZhijingJin · 2026-10-27
- ChatGPT will render genitals if you ask it to generate an X-ray of yourself — flowersslop · 2026-10-27
- Compaction Smuggling attack bypasses OpenAI mitigations to steal reasoning traces — teortaxesTex · 2026-10-27
- OpenAI backs California SB 53 safety law as AI governance shifts into practice — Comfortable_Gene5180 · 2026-10-27
- Rishi Bommasani: Anthropic's S-1 Shows the Value of Mandated Frontier AI Transparency — RishiBommasani · 2026-10-27
- Pasta Lab joins Artificial Analysis Cyber Index Alliance for AI security benchmarks — ArtificialAnlys · 2026-10-27