Security researchers have developed a worm capable of taking over WeChat accounts through an incoming call — without the victim answering the call or touching their phone.
Researchers at cybersecurity firm Calif demonstrated the attack by spreading the exploit across three test devices. According to the company, the attack works while the target’s phone is simply ringing.
The vulnerability was reported to Tencent in July. Calif says Tencent has since blocked the exploit for WeChat users.
No Interaction Required From the Victim
The attack is particularly concerning because it is a zero-click exploit, meaning the victim does not need to open a message, click a link, answer a call, or perform any other action.
There is one important limitation: the attacker must already be listed as a contact on the victim’s WeChat account.
Even answering the incoming call does not prevent the attack. Calif said the person answering the call hears nothing, while the exploit continues to work in the background.
Declining the call stops that particular attempt, but an attacker could simply try again later — potentially when the victim is asleep or otherwise unavailable.
Calif argues that the requirement to already be a contact is not a major obstacle. If an attacker compromises one WeChat account, the trust that WeChat places in contacts can potentially help the attacker target additional accounts.
Researchers Demonstrate the Worm Spreading
Calif demonstrated the attack using three phones.
First, an Android phone called an iPhone. While the iPhone was still ringing, its WeChat account was compromised.
The newly compromised iPhone then called a second Android phone. That device was subsequently taken over using the same technique.
The demonstration shows how the vulnerability could potentially spread from one compromised WeChat account to another.
Calif has not released the full technical details of the exploit and says it plans to present its complete analysis at a security conference.
What Can an Attacker Do?
According to Calif, once the exploit successfully runs, the attacker gains full control of the victim’s WeChat account.
That could allow an attacker to:
- Read and send messages
- Make calls through the account
- Impersonate the account owner
- Interact with other WeChat contacts
- Potentially use other capabilities available through the compromised account
However, Calif says the exploit does not by itself provide control of the victim’s entire smartphone.
That distinction is important. The vulnerability compromises the WeChat account rather than giving the attacker unrestricted control over the underlying Android or iOS device.
Why a WeChat Account Can Be Valuable
For many users, WeChat is far more than a messaging application.
The platform combines messaging and calling with payments, official accounts and mini programs. That makes an account takeover potentially more serious than the compromise of an ordinary chat account.
Tencent reported that WeChat and Weixin had a combined 1.439 billion monthly active users as of June 30, 2026, highlighting the enormous potential reach of the platform.
Tencent Has Released Updates
Tencent released WeChat 8.0.77 for Android and 8.0.76 for iOS on August 21, according to its release information.
Calif says those updates mitigated the vulnerability. The researchers also said that on August 28 they confirmed that Tencent had blocked the exploit on its servers.
According to Calif, Tencent has “mitigated our exploit for all users.”
The server-side protection is particularly significant because it means users do not necessarily have to install an update for the exploit to be blocked.
Nevertheless, users should still keep WeChat updated and run the latest available version.
As of September 8, the iOS App Store listing showed version 8.0.76, released August 21, as the current version.
Which Versions Were Vulnerable?
There is still some uncertainty about the scope of the vulnerability.
Neither Calif nor Tencent has publicly identified the specific WeChat versions that were affected. As a result, users cannot determine from their current version alone whether the version installed on their device in July or August was vulnerable.
Tencent also distributes WeChat clients for HarmonyOS, Windows, Mac and Linux. Neither Tencent nor Calif has publicly confirmed whether the vulnerability affected those versions.
No Known Attacks Reported
There is currently no indication that the vulnerability was used in real-world attacks.
Calif has not reported any known attacks exploiting the flaw, and the company has not published indicators of compromise that security teams could use to search for previous exploitation.
There is also no apparent way for an ordinary user to determine whether they were previously targeted simply by checking their call history.
The vulnerability is another example of why zero-click attacks are considered particularly dangerous. Similar attack techniques have previously affected major messaging platforms, including WhatsApp.
No CVE or Public Tencent Advisory
As of September 8, the vulnerability did not appear to have a publicly assigned CVE identifier, and Tencent had not published a dedicated security advisory describing the issue.
Calif said it is withholding the technical details for now and plans to disclose its full research at a conference.
That means defenders currently have limited information with which to identify or investigate potential exploitation.
Researchers Used AI During Development
Calif also described how artificial intelligence contributed to its research.
The company said it used AI to help identify the vulnerability and develop an initial exploit capable of executing code on the phone. According to Calif, that process took about two days.
The researchers said building the worm itself took another week.
However, Calif’s published timeline suggests a longer calendar period. Its engineering team identified the vulnerability on July 23, completed the first Android exploit on July 30, and demonstrated the worm on August 11.
The company did not clarify whether the shorter development estimates refer only to active working time.
What WeChat Users Should Do
For users, the most practical step is straightforward: keep WeChat updated.
Calif says Tencent has blocked the exploit on its servers, reducing the need for users to take immediate action beyond maintaining an up-to-date application.
There is currently no evidence that the vulnerability was exploited in the wild. However, because the attack requires no interaction from the victim and could potentially spread through trusted contacts, the discovery highlights the risks posed by vulnerabilities in widely used messaging platforms.
Until Tencent publishes more technical information, users also cannot determine whether a specific older WeChat installation was vulnerable.
For now, keeping the app updated and remaining alert to unexpected account activity are the safest precautions.
