WeWorm: Zero-Click WeChat Worm

WeWorm is a proof-of-concept zero-click worm that spreads through WeChat voice calls on both iOS and Android, hijacking a victim’s account while the phone rings and using it to call additional contacts. The demo chain involved a Pixel 10a calling an iPhone 17e, then the compromised iPhone calling another Pixel 10a, achieving full WeChat control—including reading, sending messages, and making calls—without user interaction. Tencent has since patched the vulnerability after it was reported in July.