WeChat Zero-Click Worm Hijacks Accounts via Calls
A silent call can compromise over a billion WeChat accounts worldwide.
1Zero-Click Exploit Discovered
Researchers at Calif discovered a zero-click worm, dubbed WeWorm, that hijacks WeChat accounts through incoming calls without user interaction. The exploit works even if the victim never answers or touches their phone. Tencent patched the flaw in August after being notified in July. The attack requires the caller to be in the victim's contacts, but a compromised friend's account can bypass this. No real-world attacks have been detected yet.
2How the Worm Spreads
The worm spreads by calling a victim, taking control of their WeChat account within seconds, and then calling their contacts. Researchers demonstrated this with a Pixel 10a calling an iPhone 17e, which then attacked another Pixel 10a. The exploit grants full account control—reading messages, making calls, and acting as the victim. Declining the call stops the attack, but unanswered or answered calls still succeed. Attackers can retry later, like when the victim is asleep.
3Technical Details
The exploit exploits a memory corruption bug in WeChat's VoIP stack, allowing trusted contacts to hijack accounts. Calif developed Android and iOS RCE demos, showing how the worm could chain with other vulnerabilities for full device control. AI helped discover the flaw and create the first RCE exploit in two days. Tencent confirmed the findings, but key details remain undisclosed until an upcoming conference. The vulnerability highlights risks in widely used apps.
4Global Impact Potential
With over 1.4 billion monthly users, WeChat's reach makes this exploit particularly dangerous. Researchers warn that attackers could compromise billions of accounts, disrupting lives and communities worldwide. The worm's ability to spread silently between devices amplifies its threat. While Tencent's patch mitigates the risk, the case underscores the dangers of zero-click vulnerabilities in popular platforms. The exploit's speed and stealth make it a potent tool for large-scale attacks.
5Limitations and Workarounds
The attack requires the caller to be in the victim's contacts, but this barrier is low. A compromised friend's account can target others in their network. Declining calls blocks the exploit, but attackers can retry. The flaw's patch prevents current exploitation, but similar vulnerabilities may exist. Researchers emphasize that AI could democratize such exploits, enabling less sophisticated actors to wield them. The incident highlights the need for proactive security in messaging apps.
6Demo and Disclosure
Calif's demo showed the worm spreading between three test phones without user action. The team withheld full technical details to prevent misuse but plans to present them at a conference. Tencent fixed the flaw on August 21, but researchers warn that chaining it with other bugs could lead to full device compromise. The exploit's discovery via AI raises concerns about future vulnerabilities being found and weaponized more quickly.
7Security Implications
The WeWorm exploit demonstrates how zero-click vulnerabilities can bypass traditional defenses. Unlike phishing or malware, it requires no user interaction, making detection harder. The researchers' use of AI to find and exploit the flaw suggests a future where such tools accelerate vulnerability discovery. This could level the playing field for less-resourced attackers, increasing the overall threat landscape for widely used apps like WeChat.
8Key Takeaways
The WeChat worm highlights critical risks in messaging platforms: zero-click exploits can silently compromise millions, trusted contacts can become attack vectors, and AI may lower the barrier for creating such threats. While patched, the flaw underscores the need for continuous security audits, faster response times, and awareness of emerging attack methods. Users should remain cautious with app permissions and update software promptly to mitigate risks.
Original article: Security Affairs — WeChat Zero-Click Worm Hijacks Accounts via Calls