Calif Demonstrates WeWorm, a Zero-Click Attack on WeChat Accounts via an Incoming Call
Researchers at Calif demonstrated the WeWorm laboratory attack, which took over a WeChat account through an incoming call without victim interaction. Tencent said it fixed the vulnerability.
Security firm Calif published research on September 8 titled WeWorm zero-click attack. In a laboratory demonstration, it was able to spread among three test phones through incoming WeChat calls across Android and iOS. According to Calif and a statement to The New York Times, Tencent confirmed and fixed the vulnerability.
The attack did not require the recipient to answer the call or take any other action. However, the attacker had to be in the target user’s contacts. Calif says the problem resulted from memory corruption in the WeChat VoIP stack. The company has not yet published the precise technical details.
WeWorm zero-click attack took over the account, not the entire device
According to Calif’s description, the flaw made it possible to take over a WeChat account. The attacker could then read and send messages, make calls, and act on behalf of the compromised user. An account taken over in this way could automatically call other contacts, enabling further spread without the victim clicking anything in the demonstration.
However, according to secondary verification, the demonstrated exploit did not provide full control over the phone. This was therefore a compromise of an account in a communications service, not a confirmed takeover of the Android or iOS operating system.
Calif calls WeWorm the first zero-click worm capable of spreading across iOS and Android. This is the researchers’ claim and cannot be definitively confirmed without an independent historical assessment.
The fix came in both the app and the server
Calif says it reported the vulnerability to Tencent on July 24 and received confirmation of mitigation on August 28. According to the company, WeChat versions 8.0.77 for Android and 8.0.76 for iOS, released on August 21, mitigated the issue. An additional server-side mitigation is intended to block the described exploit for all users.
A Tencent spokesperson confirmed the existence of the flaw and its fix to The New York Times. The company also said it had no reason to believe users were affected. No case of exploitation outside the laboratory demonstration has yet been publicly confirmed.
The scope of the flaw remains unclear
Tencent did not issue a separate security bulletin or CVE. It is therefore not publicly known which specific older WeChat versions were vulnerable, or whether the issue affected clients for HarmonyOS, Windows, macOS, or Linux. Without technical details, the full cause, scope, or effectiveness of the published mitigation also cannot be independently assessed.
The case is significant mainly because of the service’s scale: WeChat and Weixin have more than 1.4 billion monthly active accounts combined. It highlights the risk of flaws in the VoIP functions of communications apps, where recipient interaction may not be required to launch an attack.
Users should keep WeChat updated to at least version 8.0.77 on Android or 8.0.76 on iOS, or to a newer available version. Further information may come from Calif’s announced technical analysis, independent evaluation of the research, and any official clarification from Tencent about the affected platforms and versions.
Sources
- Calif – WeWorm – The researchers’ initial announcement, description of the laboratory demonstration, reporting timeline, and claim of client-side and server-side mitigation.
- The New York Times – A.I. Models Built a Computer Worm That Could Rapidly Hack WeChat Accounts – Independent reporting of a Tencent spokesperson’s statement that the company confirmed and fixed the vulnerability, with no signs of user impact.
- The Hacker News – WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls – Context on app versions, the absence of a public advisory, and the attack’s limitation to account takeover rather than full device compromise.
Verified and updated: 09/08/2026 15:26
