WeChat Zero-Click VoIP Worm WeWorm: Ring Triggers Account Takeover; Tencent Patched Server-Side
Calif disclosed WeWorm, the first WeChat zero-click worm that spreads across Android and iOS. Memory corruption in the WeChat VoIP stack: account takeover at ring, then chain spread. Tencent fully patched server-side. No in-the-wild use.
Incident
On 8 September 2026, Calif Research disclosed WeWorm, the first WeChat zero-click worm that spreads across Android and iOS. The attack gets RCE via a memory-corruption bug in the WeChat VoIP call stack. No answer, no click. Account takeover happens at ring. Tencent confirmed the issue enables remote command execution and completed a full server-side fix. No evidence of in-the-wild exploitation.
Technical details
Attack chain
- Sole prerequisite: attacker in the victim's WeChat friend list. Researchers call this a weak gate — compromise a nearby friend's account first, then call the target over that trust.
- Trigger: attacker starts a WeChat (video) call. Payload fires during ring. Account takeover in seconds. If the victim answers, they hear nothing; compromise still proceeds.
- Privileges: read and send messages, place calls, act as the victim.
- Worm self-spread: the owned account auto-calls contacts. Chain diffusion. Researchers verified cross-platform spread on multiple Android and iOS devices.
- Hang-up only stops that attempt. Attacker can re-call while the victim sleeps.
Bounds
The bug itself only takes the WeChat account, not the whole phone. Chaining with previously reported Android/iOS privilege-escalation bugs can reach device control. Full technical details and the attack chain were not published at disclosure; planned for a later security conference demo.
Impact
WeChat (incl. Weixin) combined MAU ~1.439 billion as of 30 June 2026. Super-app covering messaging, social, payments, and mini-programs. Account takeover is privacy loss plus impersonation fraud, spam, and further spread via the friend list. Researchers note AI dropped the bar: a cross-platform worm that used to take a specialist team months — here AI located the bug and produced the first RCE exploit in ~two days, worm demo in about a week.
Remediation
Vendor actions
- WeChat Android 8.0.77 and iOS 8.0.76 (shipped 21 August 2026) already mitigate the exploit.
- Tencent completed server-side block on 28 August. All users covered without client upgrade.
- Still upgrade WeChat to latest. Watch for HarmonyOS/Windows/macOS/Linux follow-on updates.
User-side
- Be cautious with unknown friend requests. Prune long-dormant, suspicious contacts.
- On unexpected account takeover: appeal via official channels immediately and warn contacts about impersonation scams.
- Treat silent "friend" calls and anomalous call requests as hostile.
Sources
- The Register: WeChat worm could pwn a friend before they even answered the call
- TechRadar: Experts build WeChat worm able to spread via phone calls
- SecurityExpress: WeWorm analysis (disclosure timeline)
- Security Internal Reference: Zero-click intrusion. New WeChat worm steals accounts without user awareness