WeWorm: Zero-Click Worm Exploits WeChat Calls to Compromise iOS and Android Devices
A proof-of-concept zero-click worm, dubbed WeWorm, can spread via WeChat voice calls, compromising accounts on both iOS and Android without user interaction.
A novel proof-of-concept zero-click worm named "WeWorm" has been demonstrated, capable of spreading through WeChat voice calls and compromising user accounts on both iOS and Android platforms. The exploit targets a memory corruption flaw within WeChat's VoIP stack, allowing it to infect a device even if the incoming call is not answered. This discovery, reported to Tencent in July, highlights a significant threat vector for one of the world's most widely used messaging applications, which boasts over 1.4 billion monthly active users across its Weixin and WeChat services.
The WeWorm worm functions by exploiting a critical memory-corruption vulnerability in the app's voice-over-IP (VoIP) handling mechanism. According to research, the worm can initiate a call to a target, exploit the flaw while the call is ringing, and achieve full control of the WeChat account without any user interaction. This "zero-click" nature makes it particularly dangerous, as traditional security precautions like avoiding suspicious links or attachments are rendered ineffective.
Researchers demonstrated the worm's cross-platform capabilities using three phones: an initial attacker device (Pixel 10a), a compromised target (iPhone 17e), and a subsequent target (another Pixel 10a). The exploit successfully propagated from the attacker to the iPhone and then from the compromised iPhone to the second Pixel device, illustrating a textbook wormable condition within a communication app.
Upon successful exploitation, WeWorm grants the attacker full control over the victim's WeChat account. This includes the ability to read and send messages, initiate calls, and perform actions on behalf of the user. The researchers suggest that this level of access could potentially be extended to gain full control of the underlying Android or iOS device, especially when combined with other device-level exploits.
While the attacker must initially be on the victim's friend list, this barrier is considered weak in practical scenarios. Once a single trusted contact is compromised, their account can be leveraged to attack their own contacts, effectively turning the social trust network into the worm's propagation layer. This pattern underscores how features designed for convenience can be weaponized by adversaries.
The technical root cause is identified as a memory-corruption bug within WeChat's VoIP stack. While full exploit details are being withheld pending further conference presentations, the nature of such flaws in real-time communication code is known to be highly sensitive, particularly when they reside in call-handling paths that process network data before user interaction.
Calif, the researcher behind WeWorm, suggests this vulnerability is indicative of a broader class of "unconventional attack surfaces" present in messaging applications. The demonstration serves as a stark warning that mobile messaging worms are a practical reality in 2026, capable of targeting massive platforms and spreading rapidly.
Tencent has reportedly mitigated the exploit for its users, but the research emphasizes the ongoing need for vigilance and robust security practices in mobile communication applications. The potential for such widespread, zero-click compromise highlights the critical importance of secure coding practices and rapid vulnerability patching in the mobile ecosystem.
This new report from The Hacker News details that the zero-click worm, demonstrated by security firm Calif, exploits an incoming call vulnerability in WeChat. While the previous report focused on the proof-of-concept and its capabilities, this article clarifies that the exploit requires the attacker to be an existing WeChat contact and that the vulnerability has since been patched by Tencent in version 8.0.77 for Android and 8.0.76 for iOS, with server-side blocking confirmed on August 28th.
This new report details the discovery and weaponization of the WeWorm, a critical zero-click vulnerability affecting WeChat. Researchers privately reported the flaw to Tencent, highlighting its potential to rapidly compromise millions of accounts across iOS and Android devices without any user interaction. The worm leverages compromised contact lists to propagate, making its spread exceptionally fast.