WeChat Zero-Click Worm Could Hijack iPhone and Android Accounts Through Incoming Calls

The research team at Calif developed a worm dubbed WeWorm, demonstrating how a compromised WeChat account could be used to infect additional accounts across both iPhone and Android devices. In a controlled demonstration, an Android device compromised an iPhone while it was still ringing, after which the compromised iPhone was used to compromise another Android device.

Tencent was notified about the vulnerability in July 2026. Calif said Tencent subsequently blocked the demonstrated exploit on its servers, meaning users do not need to perform a separate server-side remediation. However, users are still advised to run the latest available WeChat version.

No real-world exploitation has been reported in connection with this vulnerability.

Key Takeaways

• WeWorm is a demonstrated zero-click worm targeting WeChat.
• An incoming WeChat call could trigger the attack without victim interaction.
• The victim did not need to answer the call.
• Answering the call also did not prevent the exploit from succeeding.
• The attacker needed to already be a contact of the target.
• A compromised account could subsequently be used to target additional contacts.
• The demonstration successfully crossed between Android and iOS.
• Attackers could potentially gain full control of the victim's WeChat account.
• Tencent reportedly blocked the demonstrated exploit server-side.
• No confirmed attacks exploiting the vulnerability have been reported.
• The vulnerability currently has no publicly assigned CVE identifier.
• Technical exploitation details are being withheld until Calif presents its research publicly.

How the Zero-Click Attack Worked

The attack abuses the processing that takes place when a WeChat call is received.

Unlike conventional phishing attacks, the victim does not need to click a malicious link, open an attachment, approve a request, or even answer the call.

The attack sequence demonstrated by Calif was:

Attacker's WeChat Account → Incoming Call → Target WeChat Account Compromised → Compromised Account Calls Another Contact → Next Account Compromised

The attacker first calls a person who is already present in the attacker's WeChat contact list.

The malicious payload is processed while the call is being received. If successful, the target's WeChat account becomes compromised before the victim performs any meaningful interaction with the device.

Calif demonstrated the technique using three test devices, showing an Android-to-iPhone compromise followed by an iPhone-to-Android infection.

Answering the Call Does Not Stop the Attack

One particularly concerning characteristic is that answering the incoming call does not necessarily protect the victim.

According to Calif, a victim who answered the call simply heard silence while the exploitation continued.

Declining the call could terminate that particular attempt, but an attacker could potentially make another call later.

This creates a significant challenge for traditional user awareness guidance because there may be no meaningful user decision point during the attack.

The user is not being asked to "click here" or "install this application." The malicious activity occurs during the processing of the incoming communication itself.

The Wormable Component Makes the Attack More Dangerous

The most serious aspect of the research is not simply account takeover—it is propagation.

Once a WeChat account is compromised, the attacker can potentially use that account to communicate with the victim's contacts.

Because the vulnerability requires the caller to already be a WeChat contact, the contact relationship initially acts as a restriction.

However, that same trust relationship can become an advantage for a worm.

A compromised account could make calls to contacts who already trust the account, allowing the infection to move through the user's social graph.

This creates a potential chain such as:

Initial Compromise → Account Takeover → Contact List → Incoming Calls → Additional Account Takeovers → Further Propagation

Calif's demonstration showed this propagation concept across multiple devices rather than merely compromising a single test phone.

What Can an Attacker Do After Account Takeover?

The demonstrated vulnerability affects the WeChat account, rather than providing complete control over the underlying smartphone.

According to Calif, successful exploitation could give an attacker the ability to operate the compromised WeChat account as its legitimate owner.

Potential account-level capabilities include:

• Reading messages
• Sending messages
• Making WeChat calls
• Communicating with the victim's contacts
• Impersonating the legitimate account owner
• Using the compromised account as a propagation mechanism

This distinction is important: the research does not establish that the vulnerability provides unrestricted control of the entire iPhone or Android operating system.

Why WeChat Account Takeover Is a Major Security Concern

For many users, WeChat is much more than a messaging application.

The platform incorporates services including payments, official accounts and mini programs, making an account compromise potentially more significant than the loss of access to a conventional messaging service.

Tencent reported that the combined monthly active users of WeChat and Weixin reached approximately 1.439 billion as of June 30, 2026.

At that scale, a wormable zero-click vulnerability could have significant consequences if exploited in the wild.

A self-propagating attack would also introduce a different risk profile from a conventional targeted exploit because every compromised account could potentially become another launching point.

Affected Versions

Calif tested the exploit against:

Platform	Tested Version	Status
Android	WeChat 8.0.76	Exploit demonstrated
iOS	WeChat 8.0.75	Exploit demonstrated
iOS	iOS 26.6	Tested
Android	Older Android versions	Tested
HarmonyOS	Not disclosed	Not confirmed
Windows	Not disclosed	Not confirmed
macOS	Not disclosed	Not confirmed
Linux	Not disclosed	Not confirmed

Tencent subsequently released WeChat 8.0.77 for Android and 8.0.76 for iOS on August 21, 2026. Calif said these releases mitigated the vulnerability, and on August 28 the researchers confirmed that Tencent had also blocked the demonstrated exploit on its servers.

Neither Tencent nor Calif has published a complete list of affected versions, so users should not assume that an older or different build is safe simply because it is not listed above.

Server-Side Mitigation

One of the more unusual aspects of the response is that Tencent reportedly blocked the exploit at the server level.

Calif said it confirmed on August 28 that the exploit was no longer working because of protections implemented by Tencent.

This means users do not need to install a special security update to activate the server-side mitigation.

However, Tencent's latest available application releases should still be installed because the company has not publicly disclosed all technical details surrounding the vulnerability or confirmed the complete set of affected builds.

No CVE and No Public Detection Signature

As of September 8, 2026, there was no publicly assigned CVE identifier for the vulnerability.

Calif has also withheld the technical exploitation details and plans to present its findings at a future security conference.

As a result, defenders currently do not have a detailed exploit signature, public proof-of-concept or specific indicators of compromise that can be used to retrospectively identify vulnerable calls.

This also means organizations cannot reliably determine from call history alone whether a particular incoming WeChat call triggered the exploit.

AI Was Used to Discover the Vulnerability

Another notable aspect of the research is the role of artificial intelligence.

Calif said it used AI-assisted techniques to investigate the WeChat attack surface and develop the initial exploit.

The company reported that the first Android exploit capable of executing code on the device was completed in approximately two days, while the worm demonstration was developed over roughly another week.

Its detailed timeline indicates that researchers identified the vulnerability on July 23, completed the initial Android exploit on July 30, and demonstrated the worm on August 11.

The research illustrates an emerging concern for defenders: AI can increasingly assist researchers—and potentially attackers—in discovering complex vulnerabilities and rapidly turning them into working exploitation chains.

Security Recommendations

1. Update WeChat

Ensure WeChat is running the latest version available for your platform.

At minimum, users should avoid continuing to use outdated builds identified during the research.

2. Keep iOS and Android Updated

Mobile operating-system security updates provide additional protection against vulnerabilities that could be chained with application-level flaws.

3. Review WeChat Account Activity

Users should watch for:

• Unexpected messages sent from their account
• Unknown calls
• New or suspicious contacts
• Unusual account behavior
• Unexpected login or security notifications

4. Treat Unexpected WeChat Calls Seriously

Although declining an incoming call is not a guaranteed defense against this vulnerability, users should avoid assuming that answering an unexpected call makes it safer.

5. Organizations Should Monitor Corporate WeChat Usage

Where WeChat is used for business communications, security teams should consider monitoring:

• Unusual account activity
• Sudden increases in outbound calls
• Account access from unexpected locations
• Large changes in contact behavior
• Suspicious authentication events

6. Reauthenticate Compromised Accounts

If an account shows signs of compromise, users should immediately secure the account, review active sessions and authentication settings, and investigate any sensitive activity performed through the account.

What Makes This Attack Different?

Traditional mobile threats often require some form of user interaction:

Phishing Link → User Clicks → Exploit/Download → Device Compromise

The WeWorm scenario removes that interaction:

Incoming Call → Vulnerability Triggered → Account Compromised → Worm Propagates

That difference is critical.

Security awareness training remains important, but training users not to click suspicious links cannot prevent vulnerabilities that trigger while a legitimate communication is being processed.

For organizations, this reinforces the need for defense-in-depth controls at the application, device, identity and network levels.

Bottom Line

The WeWorm demonstration shows how a seemingly ordinary incoming call can become an attack vector for large-scale account compromise.

The combination of zero-click exploitation, cross-platform targeting and worm-like propagation makes the vulnerability particularly noteworthy—even though there is currently no evidence that it has been exploited in real-world attacks.

Tencent has reportedly mitigated the demonstrated exploit through server-side protections and released newer WeChat versions for Android and iOS.

Users and organizations should nevertheless keep WeChat and their mobile operating systems fully updated and treat the incident as a warning about the growing attack surface created by messaging applications.

Threat Classification

Category: Mobile Security / Zero-Click Exploit / Account Takeover
Threat Level: Critical
Primary Platforms: iOS and Android
Affected Application: WeChat
Researcher: Calif Research
Worm: WeWorm