Security company Calif has discovered weaponised, and privately reported a critical vulnerability that allowed it to create ‘WeWorm’, a worm that spreads via WeChat calls without any user interaction.

During its rampage, the WeWorm compromises the WeChat account, and uses the saved contacts to propagate itself further, potentially reaching millions of devices. The worm can hop from smartphone to smartphone, regardless of whether they are running iOS or Android.