Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

WeChat zero-click incoming-call account takeover memory corruption flaw

Vulnerability
First reported
Last updated
Happening score
H score 16
2 unique sources, 2 articles

Summary

Hide ▲

Calif disclosed WeWorm, a zero-click worm that abuses a WeChat VoIP RCE reachable through an incoming call to take over WeChat accounts on iOS and Android. The flaw is a memory corruption issue in WeChat's voice-over-IP stack, and the researchers said it relies on the privileges WeChat grants to trusted contacts. Calif said it tested the tool on Google Pixel 10a and iPhone 17e devices, while Tencent later confirmed the vulnerability could allow remote command execution and shipped patched versions for Android 8.0.77 and iOS 8.0.76. Earlier phases in the same Happening showed Calif identified the bug on 23 July 2026, completed the first Android exploit on 30 July 2026, and demonstrated a worm on 11 August 2026 that moved across three test phones without the victim answering the call. Calif said the exploit could read and send messages, make calls, and act on the victim's behalf, and that chaining with other Android and iOS bugs could lead to full device control. Tencent released the app updates on 21 August 2026, and Calif later confirmed on 28 August 2026 that Tencent had blocked the exploit on its servers for

Related Happenings

WeWorm zero-click WeChat-call worm on Android and iOS

Malware Activity
H score26 First: 09.09.2026 18:00 Last: 09.09.2026 18:00 Sources 1

How related: It is “the first zero-click worm to spread through WeChat calls across iOS and Android,” Calif researchers claimed in a disclosure report dated September 8.

About this happening: The WeWorm malware was disclosed as a zero-click worm that spreads through WeChat calls on Android and iOS, creating a path to account takeover without user intera...

Open Happening

Timeline

  1. 09.09.2026 18:00 1 articles · 12d ago

    Calif discloses WeWorm for WeChat zero-click incoming-call flaw

    Initial Disclosure

    Calif disclosed WeWorm, a zero-click worm that exploits a WeChat VoIP RCE reachable through an incoming call to hijack iOS and Android phones and take over a victim's WeChat account. The disclosure report was dated September 8, and the researchers said they tested the tool on Google Pixel 10a and iPhone 17e devices.

    Show sources
    Open in new tab
  2. 08.09.2026 14:54 1 articles · 13d ago

    Calif identifies a WeChat zero-click incoming-call bug

    Technical Analysis Update

    Calif's engineering team knew of the WeChat flaw on 23 July 2026, beginning work on a zero-click incoming-call path that could let a caller already in the target's contacts take over a WeChat account without any user interaction.

    Show sources
    Open in new tab
  4. 08.09.2026 14:54 1 articles · 13d ago

    Calif demonstrates a WeChat worm spreading across three test phones

    Exploitation Observed

    On 11 August 2026, Calif demonstrated a worm that took over a WeChat account on an iPhone while the phone was still ringing, then used that compromised account to call a second Android phone and take control of it, spreading across three test phones.

    Show sources
    Open in new tab
  6. 08.09.2026 14:54 2 articles · 13d ago

    Calif confirms Tencent server-side blocking of the WeChat exploit

    Mitigation Patch Update

    On 28 August 2026, Calif confirmed that Tencent had blocked the exploit on its servers for all WeChat users, so the mitigation did not require any user action.

    Show sources
    Open in new tab