WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls
Researchers demonstrated a zero-click WeChat worm that hijacked accounts via incoming calls; Tencent blocked the exploit server-side after July disclosure, no real attacks reported.
Security firm Calif built a worm that seized WeChat accounts via incoming calls without any target interaction, demonstrating it spreading across three test phones (Android to iPhone to Android). Once exploited, the attacker gains full control of the WeChat account, including messages, calls, payments, and mini programs, though not the phone itself. Tencent mitigated the flaw server-side, confirmed blocked on 28 August, shipping WeChat 8.0.77 for Android and 8.0.76 for iOS on 21 August. No CVE has been assigned, Tencent published no advisory, and no attacks in the wild have been reported; WeChat/Weixin counts 1.439 billion monthly active users.
- Zero-click takeover via incoming call; target need not answer, caller must be a contact.
- Worm demo spread across three phones; attacker gains full WeChat account control.
- Tencent blocked exploit server-side on 28 August; Android 8.0.77 and iOS 8.0.76 shipped 21 August.
- No CVE assigned, no vendor advisory, no attacks in the wild reported.
- Calif used AI to find the bug and write a working exploit in about two days.
From the original article
3 min read at thehackernews.com
Researchers at the security firm Calif have built a worm that takes over a WeChat account via an incoming call and demonstrated it spreading among three test phones. The person being called does not have to answer or touch their phone for it to work, but the caller must already be one of their WeChat contacts. Calif reported the flaw to Tencent in July and says the company has since
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.