Ai-powered worm exploits WeChat vulnerability, patch now available

On September 8, 2026, cybersecurity firm Calif revealed it used artificial intelligence to rapidly develop the first 'zero-click' worm targeting WeChat and WeChat. The worm, named WeWorm, spreads through voice calls and can take control of an app in seconds before spreading to contacts. The vulnerability that enabled WeWorm has been patched in Android 8.0.77 and iOS 8.0.76. Calif discovered the VoIP protocol stack memory corruption flaw in July 2026 and, with AI assistance, created a remote code execution exploit in two days, completing the worm in seven days. Calif emphasized that AI significantly reduces the time needed to develop such threats, which previously required months of work by large teams. The company urged defenders to adopt AI to counter emerging risks. Calif's findings were confirmed by Tencent's spokesperson to The New York Times. The firm highlighted the potential of AI to accelerate the creation of cyber threats, stressing the need for proactive defense strategies using similar technology.