Security Firm Demonstrates WeWorm Attack Hijacking WeChat Accounts During Ringing Phase

A security research organization has publicly released a demonstration of an attack named WeWorm. The demonstration shows that an attacker places a WeChat voice call to a user, and while the call is still ringing, the WeChat account is hijacked without the user answering, clicking a link, entering a password, or providing a verification code. The attacker thereby gains full control of the account, can read chat histories, and can send messages and place calls in the account owner's name.

A hijacked account automatically places a voice call to the next user and compromises that account in the same way, forming chain propagation. The attack can spread across platforms, with Android devices and iOS devices able to propagate it to each other.

The vulnerability has been fixed in Android 8.0.77 and iOS 8.0.76. The research team said its artificial intelligence system first discovered the vulnerability in July 2026, after which it was confirmed manually and exploitation was verified. The vulnerability was first discovered and reported by security researchers.