WeWorm – First 0-Click Worm Spreading Through WeChat Calls Across iOS and Android
Researchers demonstrated WeWorm, a zero-click worm exploiting a memory-corruption flaw in WeChat's VoIP stack to spread via calls across iOS and Android.
Security firm Calif published WeWorm, a proof-of-concept zero-click worm exploiting a memory-corruption bug in WeChat's VoIP stack to spread through voice calls on iOS and Android without the victim answering. The demo chained a Pixel 10a, an iPhone 17e, and a second Pixel 10a, compromising each device while the call was still ringing and giving full control of the WeChat account. The attacker must already be on the victim's friend list, but compromised contacts become the propagation layer across a platform with over 1.4 billion monthly users. Calif reported the bug to Tencent in July 2026, and Tencent has since mitigated it; full technical details are withheld for a later conference presentation.
- Zero-click exploitation succeeds while the call is still ringing
- Demo chain: Pixel 10a to iPhone 17e to Pixel 10a
- Grants full WeChat account control: messages, calls, actions
- Attacker must be on victim's friend list; trust graph aids spread
- Tencent mitigated after July report; details withheld for conference
- Malware
- WeWorm
From the original article
4 min read at cybersecuritynews.com
A proof-of-concept zero-click worm dubbed “WeWorm” that it says can spread through WeChat voice calls on both iOS and Android, compromising a target’s WeChat account in seconds without the victim answering the call. Calif says the bug was reported to Tencent in July and that Tencent has since mitigated the exploit for users, but the […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.