Cybersecurity firm Calif has published a security research report on WeChat and its international counterpart. Using AI assistance, the researchers discovered and developed a zero-click attack chain targeting WeChat, then fashioned a proof-of-concept worm they named WeWorm. By exploiting the vulnerability, an attacker need only place a video call to the target; even if the call goes unanswered, the victim’s account can be fully seized within seconds.
Once in control of the account, the attacker can continue launching the same attack against contacts in the victim’s friend list. In theory, the flaw could trigger large-scale WeChat account hijacking. Tencent, however, has already patched the vulnerability on the server side, rendering the attack inert. The research team intends to present the full technical details at an upcoming security conference.
The Vulnerability Lies in WeChat’s VoIP Stack
The attacker must first be on the victim’s WeChat friend list. After placing a call, the malicious code can trigger during the ringing phase even if the victim never answers. A successful exploit grants the attacker complete control of the target’s WeChat account, including the ability to read and send arbitrary messages, make calls, and act on the victim’s behalf.
More noteworthy still is the worm’s capacity for self-propagation. Once an account is compromised, WeWorm can use it to place video calls to that account’s friends and launch further attacks. The researchers tested the worm across multiple Android and iOS devices and confirmed that it can spread between the two platforms.
The Worm Controls WeChat Accounts, Not the Underlying Device
The researchers emphasize that this vulnerability is limited to seizing control of the target’s WeChat account; it does not by itself enable direct takeover of the Android or iOS device. In a real-world attack, a threat actor would likely need to chain it with additional known vulnerabilities to escalate privileges. At this stage, the researchers have confirmed that the WeChat flaw alone cannot be used to take over an entire device.
Nevertheless, for users, the WeChat account itself holds considerable value, especially for those with large friend lists. An attacker who seizes an account can impersonate the victim to commit fraud, send spam, or execute other malicious activity, making the overall threat level very high indeed.
Tencent Patched the Flaw Directly on the Server Side
On the disclosure timeline, Tencent published WeChat for Android 8.0.77 and WeChat for iOS 8.0.76 on August 21, 2026, to mitigate the vulnerability. By August 28, Tencent had blocked the attack vector on the server side, rendering the research team’s exploit ineffective for all users. On September 4, Tencent confirmed that the vulnerability could be exploited for remote command execution, and subsequently confirmed it had been fully remediated. There is currently no evidence that the flaw was ever used against real users. Thanks to Tencent’s server-side deployment, users are protected without needing to update the app, though upgrading to the latest version of WeChat is still recommended.
Disclosure Timeline
- Sometime in July 2026: AI discovered the vulnerability.
- July 23: Calif’s engineering team became aware of the bug.
- July 24: Calif reported the vulnerability to Tencent.
- July 25-28: Calif’s WeChat accounts were banned.
- July 29: Calif’s WeChat accounts were restored.
- July 30: Calif completed the first Android RCE exploit.
- August 2: Calif completed the iOS RCE exploit.
- August 11: Calif completed the polished cross-platform worm demo across Android and iOS.
- August 21: Tencent published WeChat Android 8.0.77 and WeChat iOS 8.0.76 to mitigate the vulnerability.
- August 26: Tencent notified Calif that it was assessing the issue.
- August 28: Calif confirmed that Tencent had mitigated the exploit via a server-side update.
- September 3: Calif shared its technical analysis and working exploits with Tencent.
- September 4: Tencent confirmed the vulnerability could be used for remote command execution and that the fix was complete.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
