WeChat Zero-Click Worm Demonstrated by Calif Highlights AI-Powered Threats

Security firm Calif disclosed a proof-of-concept worm, WeWorm, that hijacks a WeChat account through an incoming call with no user interaction. The exploit runs in the app’s VoIP stack, letting an attacker on the victim’s contact list read and send messages, place calls, and impersonate the user. The worm propagates automatically: a compromised device calls the victim’s contacts, repeating the process. Calif demonstrated the chain across three devices (two Android phones and one iPhone) in a lab. Tencent released updates that block the exploit on its servers and confirmed the mitigation on August 28.

Zero-click worm spreads on iPhones and Android via WeChat calls “Zero-click” WeChat worm could hijack accounts and spread via a single call WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls WeChat Worm Can Hijack Accounts Without Victims Answering Calls

WeChat, Tencent’s “super-app,” reported 1.439 billion combined monthly active users for WeChat and Weixin as of June 30 2026. Zero-click vulnerabilities have appeared in other messaging services, such as a WhatsApp flaw patched last year. Calif’s research used AI tools to locate the memory-corruption bug in the VoIP stack and develop a remote-code-execution (RCE) exploit within two days, followed by a week-long effort to build the worm.

WeChat Worm Can Hijack Accounts Without Victims Answering Calls “Zero-click” WeChat worm could hijack accounts and spread via a single call Zero-click worm spreads on iPhones and Android via WeChat calls WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

• July 23 – Identified the memory-corruption issue.

WeChat Worm Can Hijack Accounts Without Victims Answering Calls

• July 30 – Completed the first Android RCE exploit.

Zero-click worm spreads on iPhones and Android via WeChat calls

• August 2 – Finished an iOS version.

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

• August 11 – Demonstrated the cross-platform worm.

“Zero-click” WeChat worm could hijack accounts and spread via a single call

• August 21 – Tencent released WeChat 8.0.77 (Android) and 8.0.76 (iOS) with server-side mitigations.

WeChat Worm Can Hijack Accounts Without Victims Answering Calls

• August 28 – Calif confirmed the server-side block fully prevented the exploit.

Zero-click worm spreads on iPhones and Android via WeChat calls

• September 8 – Checks showed the August 21 updates remained current; no public advisory or CVE was issued.

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

• The worm spread across three test phones in seconds.

“Zero-click” WeChat worm could hijack accounts and spread via a single call

• Tencent’s user base of over one billion accounts creates a large attack surface.

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

• The exploit does not provide direct control of the device, though it could be chained with other bugs for full takeover.

“Zero-click” WeChat worm could hijack accounts and spread via a single call

Calif’s chief executive, Thai Duong, called the vulnerability “exceptional” and warned its simplicity would be “a dream come true” for malicious actors. He said the goal is to raise awareness of AI-driven security risks.

New York Times

Tencent’s release notes framed the August 21 updates as routine bug fixes. The company has not issued a public advisory or CVE. According to Calif, the mitigation operates on Tencent’s servers, protecting users without requiring the update, though using the latest version is advisable.

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

If weaponized, the worm could compromise millions of accounts within hours, leveraging trusted contacts to bypass the need for the attacker to be on the victim’s friend list. The demonstration shows how AI can accelerate discovery and exploitation of complex bugs, lowering the barrier for less-skilled actors to launch zero-click attacks. No real-world abuse has been reported, but the risk to a platform that integrates payments and mini-programs is credible.

WeChat Worm Can Hijack Accounts Without Victims Answering Calls

• No CVE or formal advisory has been published.

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

• Tencent’s notes provide no detail on the specific vulnerability.

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

• It is unclear whether the mitigation covers WeChat clients on HarmonyOS, Windows, macOS, or Linux.

WeChat Worm Can Hijack Accounts Without Victims Answering Calls

• Technical specifics of the memory-corruption bug remain undisclosed pending a future conference presentation.

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

Calif plans to present a full technical analysis of the VoIP stack flaw at an upcoming security conference and to continue researching similar attack surfaces in other messaging applications. The company urges platform owners and regulators to address AI-enabled zero-click threats proactively.

WeChat Worm Can Hijack Accounts Without Victims Answering Calls