A newly disclosed proof-of-concept worm dubbed “WeWorm” demonstrates that WeChat voice calls can be abused to compromise accounts without any user interaction. The exploit works on both iOS and Android, and target devices become hooked merely by receiving a ringing call, even before the call is answered.
How the Worm Works
The vulnerability lies in WeChat’s Voice over IP (VoIP) stack, where a memory-corruption bug allows malicious code execution while the call is still ringing. Once exploited, the attacker gains full control over the victim’s WeChat account—able to send messages, make calls, and operate in their name. The compromise can even extend toward gaining full device control via chained bugs in the operating system layer.
Crucially, the exploit is “zero-click”: the target need not answer the call or tap anything. Even if the call is answered, it emits no sound and still leads to takeover. This sets WeWorm apart—it behaves like a worm in the classic sense, where one infected device can spread the attack further to friends in the target’s social graph if they are contacts.
The Proof and Its Scope
The research, released in early September 2026 by cybersecurity firm Calif, involved tests across multiple phones. The chain of infection started with an Android device (Pixel 10a) calling an iPhone 17e, which got compromised while the call was ringing. That iPhone was then used to call another Pixel 10a, which was similarly taken over. These findings show cross-platform spread is possible.
Although the attacker must already be friends with the target on WeChat—a constraint that limits the initial attack vector—the social graph amplification effect means once one contact is compromised, further spread becomes trivial through trusted contact lists. Given WeChat’s massive reach—over 1.4 billion monthly active users globally—this kind of vulnerability could scale rapidly if left unpatched.
Tencent was alerted about the bug in July, and since then has deployed mitigations for affected users. Meanwhile, the researchers are withholding full technical details until a future conference presentation. Memory-corruption bugs in call-handling and media paths are among the highest risk in mobile apps because they provide entry before any user action.
Broader Implications
WeWorm is positioned as more than just an isolated bug—it’s a warning signal. Researchers suggest that similar vulnerabilities may lurk in other messaging platforms with rich voice or media functionality. As more apps integrate live calling, video, and media streaming, the attack surface expands for “unconventional” entry points like this.
The existence of a working wormable exploit for WeChat underscores what many in mobile security feared: zero-click worms are no longer hypothetical. They’ve moved from academic demos into realistic threats with broad reach, especially in popular apps used daily by billions.
What this means: Wormable, zero-click attacks represent one of the highest tiers of mobile risk. Users of major messaging apps must demand stronger isolation of network-input processing, rigorous memory safety, and prompt patching. For platforms, this illustrates the urgent need to scrutinize VoIP stacks and call paths as critical components—not just add-on features.
