Emerging Agentic Threat: AI-Engineered 'WeWorm' Exploits Zero-Click WeChat Calls to Hijack Accounts and Self-Propagate
Executive Summary
Cybersecurity researchers have published detailed technical findings on WeWorm, a groundbreaking and dangerous self-propagating computer worm developed with generative AI assistance targeting Tencent's WeChat messaging and social ecosystem (Help Net Security, Ground News). WeWorm achieves account takeover via an incoming zero-click voice or video call requiring zero user interaction—the victim does not need to answer the call, click a link, or open a file. Once an account is hijacked, the AI-guided worm automatically harvests contact rosters and initiates calls to secondary users, creating a viral infection chain capable of spreading across millions of devices in hours.
Deep-Dive Technical Analysis
Zero-Click VoIP Memory Corruption & Automated Propagation
WeChat connects more than 1.3 billion active users globally, serving as primary communication, banking, and identity infrastructure across Asia and international diaspora communities. Technical breakdown of WeWorm's execution lifecycle reveals:
1. Pre-Answer Codec Buffer Overflow: When an incoming VoIP call is initiated, WeChat's client software immediately initializes media handshaking routines and real-time audio/video codec decoders (such as Opus/H.264 packet parsers) to negotiate stream parameters before the user accepts or declines the call. WeWorm transmits malformed Real-time Transport Protocol (RTP) packets containing oversized stream parameter headers, triggering a heap buffer overflow in unmanaged C/C++ media parsing libraries.
2. In-Memory Shellcode Execution: The overflow corrupts memory pointer tables and bypasses operating system protections (including ASLR and Data Execution Prevention), executing an in-memory shellcode payload that runs with the privileges of the active WeChat process on Android, iOS, or desktop clients.
3. Account Session Hijacking: The payload extracts active session tokens, local SQLite encryption keys, and contact databases directly from process memory. It establishes an authenticated session under the victim's identity without alerting the user or generating suspicious login alerts.
4. AI-Assisted Self-Propagation: Demonstrating autonomous agentic worm tradecraft, WeWorm iterates through the victim's recent chats, family groups, and professional contacts. It automatically generates targeted outbound VoIP packets to all discovered peer IDs, recursively triggering the zero-click buffer overflow on contacts' devices.
5. Data Exfiltration & Secondary Payloads: In addition to propagation, WeWorm dumps unencrypted chat histories, contact metadata, and voice memos to external command-and-control (C2) servers, with the capability to drop persistent info-stealers or spyware onto compromised endpoints.
The Shift to AI-Built Autonomous Worms
WeWorm marks a pivotal escalation in modern software exploitation:
* Accelerated Exploit Synthesis: Researchers demonstrated that threat actors utilized advanced AI code-generation models to analyze compiled binary disassembly, discover protocol-level edge cases, and craft functional multi-stage memory corruption exploits that historically required months of specialized human research.
* Zero-Click Scale: Because zero-click exploits require no user error or gullibility, traditional security awareness training is entirely ineffective at stopping the worm's propagation.
Actionable Recommendations & Mitigations
1. Update WeChat Applications Across All Platforms: Ensure that all mobile (iOS and Android) and desktop (Windows and macOS) WeChat installations are upgraded to the latest patched releases issued by Tencent.
2. Restrict Inbound Calls from Unknown Contacts: Configure application privacy settings to block incoming voice and video calls from accounts not present in the user's verified contact list.
3. Deploy Mobile Threat Defense (MTD) & Process Monitoring: Enterprise IT and MDM administrators should mandate Mobile Threat Defense agents capable of detecting anomalous memory allocation spikes and unauthorized SQLite database access originating from messaging applications.
4. Network-Level VoIP Protocol Inspection: Enterprise firewalls and secure web gateways should inspect and filter non-standard RTP/SIP packet headers and throttle high-frequency, automated peer-to-peer VoIP connection attempts.
________________
Sources & References: Help Net Security, Ground News.