Researchers demonstrate zero-click WeChat worm spreading via calls on iOS and Android

Calif Research has demonstrated a worm that propagates through WeChat calls without any user interaction. The exploit succeeds whether the call is answered or ignored, and the victim hears nothing. This removes the last practical barrier to mobile malware propagation: the need for a user to perform an action such as opening a message or installing an app.

The worm works on both iOS and Android, meaning it can spread across the two dominant mobile platforms. WeChat’s cross-platform nature provides a single attack surface that reaches the majority of smartphone users. The exploit does not rely on platform-specific vulnerabilities, making it harder to contain through OS-level patches alone.

The team developed the exploit in about two days and built the worm in one additional week, using AI assistance. This speed suggests that the barrier to entry for sophisticated mobile malware is dropping. AI can automate much of the exploit development process, leaving researchers to focus on target selection and testing.

The demo is a proof of concept, not an active threat, but it highlights the potential for rapid, large-scale mobile infections. The lack of user interaction means traditional defenses such as user education or app sandboxing are ineffective. Network-level detection and WeChat’s own security mechanisms become the primary lines of defense.