WeChat Zero-Click Worm Hijacked Accounts on iPhone and Android Through Incoming Calls

A security firm turned a WeChat bug into a worm that takes over an account while the phone is still ringing. No tap, no answer, no user action at all. Calif demonstrated it jumping across three test phones: an Android device called an iPhone and took over its WeChat, and the compromised iPhone then called a second Android device and did the same thing. The account at stake is not just a chat log. Tencent reported 1.439 billion combined monthly active users for WeChat and Weixin as of June 30, 2026, and that account carries payments, official accounts and mini programs.

Tencent has closed it. Calif reported the flaw in July, Tencent shipped 8.0.77 for Android and 8.0.76 for iOS on August 21, and on August 28 Calif confirmed the exploit was blocked on Tencent's servers as well. There is no CVE, no Tencent advisory and no published indicator you can search for. That combination is the real story: the exposure is shut, and you have almost no way to establish what happened on your fleet before it was.

What the exploit actually does

The trigger is an incoming WeChat call from someone already in the target's contact list. The target does not have to answer or touch the device. Answering does not help either: Calif said a person who picks up hears nothing while the exploit runs. Declining the call ends that attempt, and it is the only user action that stops it, but the attacker simply calls again later, for example while the target is asleep.

Once the exploit runs, the researchers said the attacker has full control of the WeChat account and can read and send messages, make calls and act as the account's owner. It does not hand over control of the phone itself. For a corporate threat model that distinction matters less than it sounds, because in many markets WeChat is where the vendor threads, the deal negotiations and the payment approvals live.

The contact requirement is the propagation engine

The caller must already be a contact. That reads like a mitigating control and functions as the opposite. Every account the worm takes over inherits a fresh contact list, and the extra trust WeChat extends to contacts now works for the attacker instead of the user. That is exactly what the three phone demo shows: one hop per compromised account, no user interaction anywhere in the chain. Calif's writeup also describes routes an attacker could use rather than ones it tested, so treat the spread model as demonstrated at small scale and plausible at large scale, not measured.

Versions: what is known and what is guesswork

Calif told The Hacker News it tested against WeChat 8.0.76 on Android and 8.0.75 on iOS, in each case one release below what Tencent shipped on August 21. Test devices ran iOS 26.6 and some older Android builds. Neither company published a list of affected versions, so a device on any other build cannot be classified either way. Tencent also ships WeChat clients for HarmonyOS, Windows, Mac and Linux on their own release schedules. Calif declined to say whether it tested any of them, and Tencent has not addressed them. Treat desktop and HarmonyOS clients as unknown, not clean.

Calif said the block runs on Tencent's servers, so it applies without users installing anything. Running current is still the safer posture. As of September 8 the App Store listing showed 8.0.76, released August 21, as the current version.

The two day exploit claim, read carefully

Calif said it worked with AI to find the bug and write the first exploit capable of running code on the phone in about two days, with the worm taking another week. Its own timeline is looser: the engineering team knew of the bug on July 23, the first Android exploit was finished on July 30, and the worm demo ran on August 11. That is roughly three weeks end to end, and the post does not say whether the shorter figures count working time only. The claim worth taking seriously is the method rather than the stopwatch. Calif says it designed a set of skills that guide an AI in exploring and identifying attack surface in messaging apps, and that the AI discovered this flaw using them. Plan on the cost of finding zero-click bugs in large messaging clients continuing to fall.

What to do this week

• Set a hard version floor: WeChat 8.0.77 or later on Android, 8.0.76 or later on iOS. Anything below that is out of policy even with the server-side block in place.
• Pull WeChat versions from MDM inventory instead of asking users. Jamf and Intune both expose a per-app version field you can query and alert on.
• Inventory the desktop and HarmonyOS clients as well, and record their status as unknown rather than clean, because no vendor statement covers them.
• Treat high risk users separately: executives, legal, deal teams and anyone traveling to markets where WeChat is required. A separate device is a reasonable control here.
• Do not wait for a CVE to feed your vulnerability scanner. There is not one, and there may never be.

adb shell dumpsys package com.tencent.mm | grep -i versionName
curl -s 'https://itunes.apple.com/search?term=wechat&entity=software&limit=5' | jq '.results[] | {trackName, bundleId, version}'
defaults read /Applications/WeChat.app/Contents/Info.plist CFBundleShortVersionString

The realistic worst case is not this specific bug, which appears to be handled. It is the shape of it: a zero-click reachable through an inbound call, on a client with 1.439 billion monthly active users, closed by a server-side switch with no advisory, no identifier and no detection content. If the next one is found by someone less cooperative, the first signal you get will come from your users.

adb shell dumpsys package com.tencent.mm | grep -i versionName

for d in $(adb devices | awk 'NR>1 && $2=="device"{print $1}'); do echo "== $d"; adb -s "$d" shell dumpsys package com.tencent.mm | grep -i versionName; done

curl -s 'https://itunes.apple.com/search?term=wechat&entity=software&limit=5' | jq '.results[] | {trackName, bundleId, version}'

adb shell am start -a android.intent.action.VIEW -d 'market://details?id=com.tencent.mm'

adb shell pm disable-user --user 0 com.tencent.mm

defaults read /Applications/WeChat.app/Contents/Info.plist CFBundleShortVersionString