WeWorm: The Zero-Click WeChat Worm That Hijacks Accounts Mid-Ring

## WeWorm: The Zero-Click WeChat Worm That Hijacks Accounts Mid-Ring

A phone rings. Nobody answers. The account gets hijacked anyway — and starts calling the victim's own contacts to spread further.

That's WeWorm, a proof-of-concept built by security firm Calif, demonstrating the first zero-click worm capable of spreading through WeChat calls on both iOS and Android.

The bug

Calif found a memory-corruption flaw inside WeChat's VoIP call-handling stack — the code path that runs before the recipient interacts with the call at all. No phishing link, no malicious attachment, no user action required.

The attack chain

• Device A (attacker) calls Device B
• Device B compromised mid-ring, before anyone answers
• Device B automatically calls Device C, repeating the exploit
• Chain works cross-platform: iOS ↔ Android

Timeline

• 2026-07-24: Reported to Tencent
• 2026-08-21: Patched clients shipped (Android 8.0.77 / iOS 8.0.76)
• 2026-08-28: Server-side mitigation completed
• 2026-09-08: Public disclosure

No CVE has been published; Calif is withholding the full exploit chain until a conference talk.

Why this matters for engineers

Calif says AI-assisted vulnerability research cut exploit development from a typical multi-month timeline down to ~10 days. That's a meaningful shift for anyone owning patch SLAs, threat modeling, or pre-auth code paths (call setup, media negotiation, etc.) — this is exactly the kind of "runs before user interaction" logic that needs fuzzing and memory-safety auditing.

Mitigations if you build messaging/VoIP features

• Fuzz pre-authentication code paths specifically
• Don't assume "unanswered" = "safe"
• Add behavioral anomaly detection (unexpected outbound call/message bursts)
• Treat vendor-app patch SLAs (WhatsApp, Signal, WeChat) as part of your org's vuln management, not just OS-level CVEs

Full technical writeup: https://www.xpert4cyber.com/2026/09/weworm-wechat-zero-click-worm.html