Researchers disclose WeChat zero-click call worm

Security researchers have disclosed a zero-click worm capable of hijacking WeChat accounts through incoming calls on both iPhones and Android phones, although the exploit has been mitigated before public release.

California-based security firm Calif said its WeWorm demonstration exploited a memory-corruption flaw in WeChat’s voice-over-IP stack, allowing a compromised account to call another user and seize control of that account within seconds without the target answering or touching the phone.

The researchers said Tencent, which operates WeChat, had mitigated the exploit for all users by the time the findings were published on September 8. Calif said Android version 8.0.77 and iOS version 8.0.76, issued on August 21, addressed the weakness, while a server-side measure confirmed on August 28 blocked the exploit across the service.

Calif demonstrated the worm on three test phones. A Pixel 10a was used to call an iPhone 17e, whose WeChat account was taken over while the handset was still ringing. The compromised iPhone then called another Pixel 10a and took control of its WeChat account in the same way, showing how an infected user could automatically become the next source of propagation.

No evidence has emerged that the flaw was exploited against WeChat users outside the researchers’ controlled testing, and Calif has not claimed that the worm was deployed in the wild. The company is withholding technical details of the vulnerability pending a fuller presentation at a security conference.

A Tencent spokeswoman confirmed the vulnerability had been fixed after Calif contacted the company and said there was no reason to believe it had compromised security or affected users. Tencent’s second-quarter figures put combined monthly active users of WeChat and Weixin at 1.439 billion at the end of June. Calif also briefed White House officials before disclosure, highlighting the wider concern that AI-assisted vulnerability research can accelerate both offensive testing and defensive remediation.

The exploit required the calling account to be on the target’s WeChat friend list. Calif said that limitation did not prevent worm-like spread because a hijacked account could use its existing trusted relationships to reach further contacts. Declining an incoming call stopped that particular attempt, but merely answering the call did not: the researchers said the user would hear nothing while exploitation continued.

Successful exploitation gave control of the WeChat account, including the ability to read and send messages, place calls and act on the user’s behalf. Calif said the WeChat flaw alone amounted to remote code execution within the app context; taking full control of a phone would require chaining it with additional operating-system vulnerabilities.

The research has drawn attention partly because Calif said artificial intelligence substantially accelerated the work. The company said its team, working with AI, found the bug and produced the first remote-code-execution exploit in about two days, then spent another week building the self-propagating worm.

Its disclosure timeline shows the engineering team became aware of the flaw on July 23 and submitted it to Tencent the following day. Calif completed an Android exploit on July 30, an iOS exploit on August 2 and a polished cross-platform worm demonstration on August 11. Tencent confirmed on September 4 that the vulnerability could be used for remote command execution, according to the researchers.

The case illustrates the continuing risk posed by zero-click flaws in communications software, where complex processing can occur before a user decides whether to accept an incoming message or call. Such weaknesses are particularly difficult for users to defend against because exploitation may begin without any deliberate action on the device.

Calif described WeWorm as the first zero-click worm demonstrated to propagate through WeChat calls across iOS and Android. That characterisation is the researchers’ claim rather than an independently established industry classification, but the cross-platform propagation shown in their test distinguishes the work from a conventional one-device proof of concept.