WeChat Zero-Click Worm: How WeWorm Could Hijack Your Account Before You Answered

Your phone rings. You ignore it.

In Calif's lab, the call had already done its work.

The security firm demonstrated a memory-corruption flaw in WeChat's voice-over-IP stack that could be triggered before the recipient answered. Calif turned the flaw into remote code execution on Android and iOS, then linked three phones into a worm: an Android device called an iPhone, seized its WeChat account while it was still ringing, and used the compromised account to call a second Android phone. Calif says the attacker could read and send messages, make calls and act through the victim's account.

Tencent fixed the exploit before Calif disclosed it publicly on 8 September, and the company says it found no evidence that anyone used it in the wild. Those facts separate a frightening laboratory demonstration from an actual outbreak.

WeWorm exposed a structural weakness in the super-app model. The same density of trusted relationships that makes a social platform useful can give a worm its route to the next victim. The more functions one account accumulates, the more consequential that account becomes when an attacker takes it over. AI adds a second pressure by making sophisticated exploit work faster and cheaper.

The business logic of a super-app is straightforward. Every task absorbed by one account makes the service more convenient and harder to leave. WeWorm shows the other side of that concentration: each added privilege can raise the value of a successful takeover.

When a friend becomes the delivery system

Calif reported the bug to Tencent on 24 July. Its WeChat accounts were banned from 25 to 28 July and restored on 29 July. There is no public evidence that Tencent imposed those suspensions in retaliation for the disclosure, so the chronology should not be turned into a motive. Calif completed its first Android remote-code-execution exploit on 30 July, an iOS version on 2 August and a polished cross-platform worm demo on 11 August. Tencent released mitigating Android and iOS versions on 21 August. Calif says it confirmed a server-side mitigation for all users on 28 August; Tencent confirmed the remote-code-execution risk on 4 September.

The exploit had an important constraint: the caller had to be on the victim's WeChat friend list. In an ordinary attack, that would narrow the target pool. In a worm, it can help solve the distribution problem. Once an attacker has compromised one account, that account already has trusted relationships with other accounts.

For a worm, the friend list doubles as a route map.

Calif's three-phone demonstration was small, and there is no evidence that the worm could have swept through 1.4 billion users at laboratory speed. Real networks contain dead ends, rate limits, detection systems and people who decline calls. The public technical analysis is also incomplete because Calif is withholding details while related attack surfaces are fixed.

A compromised account can inherit the social standing of its owner. The next target sees a call from someone already inside their network of trust. The social graph, normally one of the platform's strongest competitive assets, can then help carry the attack.

Tencent reports more than 1.4 billion monthly active users across Weixin and WeChat. Within Weixin, Mini Programs reach shopping, travel, healthcare, utilities and other services. One identity, one contact graph and one interface remove friction from daily life. Every additional service makes the account more central.

That convenience raises the value of an account takeover. Calif demonstrated control of the WeChat account, not automatic access to every service on the phone. It did not show that separate payment authentication could be bypassed, and full device compromise would have required additional vulnerabilities. Even within those limits, an attacker who can read messages, impersonate the victim and call trusted contacts has acquired something more useful than access to a stand-alone app.

AI changed the calendar

Calif says its AI discovered the underlying bug in July. After its engineers became aware of it, the team says it produced the first working RCE exploit in about two days and built the worm in another week. Calif also says similar work once required larger teams and months of effort. Until the full technical analysis is released, outsiders cannot independently measure how much of that speed came from AI, existing expertise or the particular bug.

Britain's National Cyber Security Centre warned in 2025 that AI-assisted vulnerability research and exploit development would be the most significant near-term change in AI-enabled cyber operations. It noted that the interval between disclosure and exploitation had already fallen to days and expected AI to shorten it further. The NCSC also rejected the fantasy of fully autonomous elite hacking in the near term: skilled people remain in the loop.

AI can transform exploit economics without replacing an exploit developer. Giving a good researcher ten times as many useful hypotheses, faster code generation or quicker analysis of unfamiliar components can change the number of bugs a small team can investigate and the speed with which it can turn one into working code.

Defenders inherit the same tools. Calif's own argument is that AI should help find vulnerabilities before criminals do. Tencent is pursuing that logic too; its security response centre now promotes AI-based zero-day discovery alongside human bug-bounty programmes.

The race speeds up on both sides. A patch process that looked adequate when weaponisation took months can become dangerous when a capable team needs days.

WeChat already sits inside the trust boundary

WeChat's existing trust model makes the episode more uncomfortable because the platform already has unusual visibility into its users.

Citizen Lab found that WeChat lacks end-to-end encryption for chat messages, giving Tencent visibility into messages sent through the platform. Its research has also documented automated keyword censorship for mainland-China accounts. A separate 2025 study found pervasive first-party tracking in Mini Programs, with users and developers unable to opt out of that collection.

End-to-end encryption would not have prevented memory corruption in a call-processing component. The relevance is the amount of trust already concentrated in the platform. Users hand WeChat access to communications and a growing range of daily services; the account also carries an established social identity that other people recognise.

That makes client security unusually consequential. If an attacker gains control of a WeChat account, the value comes partly from everything the platform already knows and partly from everything other users believe about the person behind that account.

Tencent's security record complicates the easy claim that the company simply ignored security. It has a formal security-response programme, and its 2026 bounty campaigns explicitly covered WeChat clients, chat, audio and video, Mini Programs and WeChat Pay. During the period when Calif was developing WeWorm, Tencent was running an enhanced campaign offering higher rewards for serious flaws in WeChat and other products.

The record shows a company that invests in security and still shipped a bug with worm potential. Software at WeChat's scale contains enormous amounts of code across multiple operating systems, old components, new product code and interactions that no test suite can exhaust. At this scale, an active security programme is competing continuously with the complexity of the product it is trying to defend.

Tencent's response also leaves a transparency question. Calif says Tencent mitigated its exploit for all users, and Tencent later confirmed the server-side fix. The Hacker News reported that Tencent had published no specific security advisory for the flaw and that the relevant release notes described only generic bug fixes. Calif would not say whether the underlying defect itself had been fixed, only that its exploit had been mitigated.

For a consumer app with ordinary reach, that opacity is irritating. For a platform woven into communication, payments and public services, it deserves more scrutiny.

Super-apps should be judged by blast radius

Software regulation still tends to follow categories: bank, telecoms provider, social network, operating system. Super-apps blur those categories because they collect the functions of several systems under one identity.

Security policy should follow the consequences of failure. A platform used by more than a billion people for communication and daily services deserves controls proportional to the damage a single account-level exploit can cause. That means reducing work done before a user accepts an interaction, isolating risky parsers and call components, moving suitable code into memory-safe languages, maintaining server-side kill switches and testing high-risk paths continuously with the same AI-assisted methods attackers can use.

Disclosure matters too. When a vulnerability can propagate through trusted relationships, enterprise defenders and users should not have to infer its severity from a release note that says only that known issues were fixed.

The usual platform metrics celebrate how thoroughly a service has embedded itself in users' lives: monthly active users, transaction volume, time spent and service breadth. Each can also raise the cost of a security failure.

A better security metric asks how much a compromised account can do before another control stops it.

For WeChat, WeWorm gives that question a concrete shape. A trusted incoming call could reach vulnerable code before the recipient consented to anything. The compromised account could then place the next trusted call. AI helped Calif move from discovery to a cross-platform worm in days. None of those facts requires a billion-device outbreak to matter.

WeWorm never escaped the lab. Tencent says no users were affected, and the exploit has been mitigated. We get to study the episode as a warning rather than an incident report.

The episode exposes the limit of familiar mobile-security advice. Much of that advice asks users to recognise suspicious links, attachments and downloads. Those habits remain sensible. They offer little protection when dangerous code runs while a trusted friend's call is still ringing.

Your phone rings at two in the morning. You leave it alone, which is exactly what years of security advice taught you to do.

WeWorm's lesson is that the next attack may arrive before you get a chance to make a mistake.

Sources

• Calif, “WeWorm” — primary vulnerability disclosure, exploit demonstration and mitigation timeline. https://calif.io/research/weworm

• Tencent, Weixin & WeChat — platform scale and product scope. https://www.tencent.com/products/weixin-wechat/

• Citizen Lab, “Should We Chat, Too?” — analysis of WeChat’s encryption architecture and server-side message visibility. https://citizenlab.ca/research/should-we-chat-too-security-analysis-of-wechats-mmtls-encryption-protocol/should-we-chat-too-faq/

• Citizen Lab, “Privacy in the WeChat Ecosystem” — research on tracking and data collection across WeChat Mini Programs. https://citizenlab.ca/research/privacy-in-the-wechat-ecosystem-full-report/

• UK National Cyber Security Centre, “Impact of AI on cyber threat from now to 2027” — assessment of AI-assisted vulnerability research and shrinking exploit timelines. https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027

• Tencent Security Response Center — WeChat vulnerability reporting and bounty programme. https://security.tencent.com/index.php/blog/msg/342