Full Report
Researchers at the security firm Calif have built a worm that takes over a WeChat account via an incoming call and demonstrated it spreading among three test phones. The person being called does not have to answer or touch their phone for it to work, but the caller must already be one of their WeChat contacts. Calif reported the flaw to Tencent in July and says the company has since
Analysis Summary
# Vulnerability: WeChat Zero-Click Remote Code Execution Worm
## CVE Details
- **CVE ID:** Not yet assigned (As of Sept 2026)
- **CVSS Score:** N/A (Estimated Critical)
- **CWE:** Unknown (Technical details currently withheld by researchers)
## Affected Systems
- **Products:** WeChat (Tencent)
- **Versions:**
- Android: Versions prior to 8.0.77
- iOS: Versions prior to 8.0.76
- Other platforms (Windows, Mac, Linux, HarmonyOS): Status unconfirmed
- **Configurations:** The attacker must be in the target's WeChat contact list.
## Vulnerability Description
This is a zero-click vulnerability affecting the WeChat mobile application's calling functionality. The flaw allows for remote code execution (RCE) via an incoming call. The target does not need to answer or interact with the device for the exploit to trigger. The vulnerability enables the creation of a "worm," where a compromised account can automatically call and infect other contacts in its list, facilitating rapid, automated spreading.
## Exploitation
- **Status:** PoC available (Demonstrated by Calif researchers); No known exploitation in the wild.
- **Complexity:** Low (Zero-click; no user interaction required).
- **Attack Vector:** Network (Incoming WeChat call).
## Impact
- **Confidentiality:** High (Attacker can read messages and access account data).
- **Integrity:** High (Attacker can send messages and make calls as the account owner).
- **Availability:** High (Full account takeover).
- **Note:** The exploit grants full control of the WeChat account and its integrated features (payments, mini-programs) but does not currently grant full control of the underlying mobile operating system.
## Remediation
### Patches
Tencent has reportedly implemented server-side mitigations and released updated client versions. Users should update to the following versions or later:
- **Android:** 8.0.77 (Released August 21, 2026)
- **iOS:** 8.0.76 (Released August 21, 2026)
### Workarounds
- Ensure the application is updated to the latest version via the official App Store or Google Play Store.
- While the server-side block is active, maintaining a "clean" contact list is a recommended security posture, as the exploit relies on the "trusted" status of existing contacts.
## Detection
- **Indicators of Compromise:** Unusual outgoing calls to contacts that the user did not initiate; unauthorized messages sent from the account.
- **Detection Methods:** Currently, there is no built-in way for a user to see if a silent call exploit was attempted. Calif researchers have not yet released specific forensic indicators (IoCs) or logs to search for.
## References
- Calif Research: [hXXps://calif[.]io/research/weworm]
- WeChat iOS Release Log: [hXXps://weixin[.]qq[.]com/updates?platform=ios&version=8.0.76]
- Original Reporting: [hXXps://thehackernews[.]com/2026/09/wechat-zero-click-worm-took-over.html]