AI Tool Hijacked WeChat Accounts via Unanswered Voice Calls

AI-Powered Exploit Demonstrated Remote WeChat Takeover

A California-based cybersecurity firm has revealed how artificial intelligence compressed months of security research into days, creating an experimental exploit capable of hijacking WeChat accounts through unanswered voice calls.

Calif disclosed Tuesday that its AI system identified a critical vulnerability in Tencent Holdings' messaging and payments platform in July. Within slightly more than a week, researchers constructed WeWorm—an experimental tool that could grant attackers complete control of a target's WeChat account through a simple voice call that the victim never answered.

Tencent deployed a server-side fix in late August after Calif reported the security flaw, according to the disclosure. The patch required no action from WeChat's user base.

No Evidence of Real-World Exploitation

A Tencent spokesperson confirmed Wednesday that the company implemented the fix and found no indication the vulnerability had been exploited outside controlled research environments. The company expressed appreciation for the researchers' responsible disclosure and collaborative approach to remediation.

The incident highlights a significant shift in cybersecurity threat development. Calif researchers noted that exploits of this sophistication historically demanded months of effort from substantial engineering teams. The firm's findings suggest AI systems can now handle the majority of this technical work independently.

Why It Matters

This demonstration reveals how AI fundamentally alters the economics and timelines of cyber threat development. Vulnerabilities that once required significant human expertise and time investment can now be identified and weaponized in days rather than months. For enterprise security teams, this compression means the window between vulnerability discovery and potential exploitation has narrowed dramatically. Organizations relying on platforms like WeChat for business communications and transactions face an evolving threat landscape where defensive responses must accelerate to match AI-enhanced offensive capabilities.

Implications for US-China Cyber Relations

The disclosure has renewed discussions about cybersecurity cooperation between the United States and China. The successful collaboration between a US security firm and Chinese technology company on this vulnerability demonstrates the potential value of bilateral information sharing, even as broader geopolitical tensions persist between the two nations.

WeChat serves as a critical communications and payments infrastructure for more than a billion users, making vulnerabilities in the platform particularly consequential for both individual privacy and commercial security.

These details were first reported by the South China Morning Post.