Quoting Calif Research

Calif Research's WeWorm account describes an attack that could take over a WeChat account while an incoming call was ringing, then use that account to call another victim. The attacker had to be an existing contact, so propagation depended on exploiting that trusted relationship. The researchers report a three-phone demonstration spanning Android and iOS, and say AI helped them produce the initial exploit in about two days. That timing is the team's account, without a controlled comparison. Calif also reports that Tencent mitigated its exploit for all users before publication, with server-side mitigation confirmed on August 28, 2026.