WeWorm: first zero-click worm spreading via WeChat calls across iOS and Android
emollick · x · 2026-09-09
Calif Research has demoed WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android (covered by the NYT).
- Attackers only need to place a call — no answer or interaction required — hijacking the WeChat account within seconds, even while the phone is still ringing
- A three-phone chained demo: a Pixel 10a calls an iPhone 17e and takes over its WeChat, then the compromised iPhone attacks the next Pixel — victims become attackers
- Full account control: reading/sending messages, calls, impersonation; chained with other reported bugs it could yield complete device control
- Potential exposure exceeds a billion phones/accounts. Ethan Mollick adds that however worried companies are about cybersecurity, it's not enough — and the Hugging Face Incident shows you don't even need bad actors
Related event: WeWorm: Zero-Click Worm Hijacks Accounts via WeChat Calls(3 posts)→
More from Fun
- The joke: Anthropic ships its S-1 so everyone burns Claude tokens summarizing it — ericwdolan · 2026-10-27
- 3am open-heart surgery on a Unitree G1 in Zurich sparks 'robot hospitals' meme — lukas_m_ziegler · 2026-10-27
- First-week PhD student lands ARR Area Chair role, exposing peer-review quirks — anmarasovic · 2026-10-27
- User tricks Gemini into revealing his precise GPS coordinates with a joke — kimmonismus · 2026-10-27
- Player rebuilds Street Fighter II in HD with Claude: $3,000 of tokens, 3 weeks — Fantastic-Jeweler781 · 2026-10-27
- Her ex-boss wants to clone her voice for his chief-of-staff agent — evielync · 2026-10-27