InfoSecBulletin Cybersecurity for mankind
A worm called “WeWorm” can spread through WeChat voice calls on iOS and Android. It takes over a target’s WeChat account in seconds without the victim having to answer the call.
Calif researchers said the bug was reported to Tencent in July. Tencent has fixed the issue for users, but the research warns how mobile messaging apps can be targets for attacks on a global level.
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
According to Calif’s public research listing, WeWorm is described as “the first zero-click worm to spread through WeChat calls across iOS and Android,” and it was published on September 8, 2026, as part of the company’s Android-tagged research work.
Calif sees the finding as a real example, not just a theory, of how a trusted messaging relationship can be abused. One hacked contact can start attacks on all their friends.
The company’s demo showed that three phones were used to test cross-platform connections. A Pixel 10a was the main attacker phone. It called an iPhone 17e and took advantage of a weakness while the call was ringing. The hacked iPhone then called another Pixel 10a, which was also taken over in the same way.
A wormable condition in a communications app means the attacker calls the victim, the victim then becomes the attacker, and the infection spreads easily. Click here to see the full report.
Related News:
Worm GPT for hackers, ‘No Ethical Boundaries or Limitations’
PlugX Malware Plagues Over 90k IP Addresses over 170 countries
