Experts build WeChat worm able to spread across millions of iPhone and Android devices via phone calls

WeChat, the “super‑app” with roughly 1.4 billion users, has been shown to host a zero‑click vulnerability that lets a worm hijack accounts on both iPhone and Android devices without any user interaction, a development that threatens the privacy of anyone who relies on the platform for messaging, payments, and even government services.

Zero‑Click Vulnerability Mechanics

The flaw resides in WeChat’s VoIP stack, where a memory‑corruption bug allows malicious code execution as soon as the app processes an incoming call packet. Because the exploit does not require the user to answer, tap, or even notice the call, it bypasses the traditional “user‑action” defense model that most mobile security solutions depend on. This shift from click‑based to zero‑click attacks expands the attack surface dramatically, forcing defenders to reconsider threat models that assumed user consent as a safety net.

Researchers from Calif disclosed the issue without releasing the technical details, opting instead to demonstrate a proof‑of‑concept worm called WeWorm at an upcoming conference. By keeping the exploit private, they aim to pressure the vendor into rapid remediation while avoiding mass exploitation in the wild. The decision underscores a broader ethical debate in vulnerability research: whether full disclosure accelerates patches or fuels malicious actors.

Worm Propagation via VoIP Calls

WeWorm leverages the fact that WeChat’s call function can reach any contact in the attacker’s address book, regardless of the target’s device model or operating system. Once the attacker initiates a call, the worm embeds itself into the call‑setup payload; the moment the phone starts ringing, the malicious code injects itself, granting the attacker control over the victim’s WeChat account. Even if the victim declines the call, the attack halts only temporarily, as the attacker can simply place another call, making denial a weak mitigation.

This propagation model is particularly insidious because it transforms a routine communication channel into a mass‑distribution vector. Unlike traditional malware that spreads via links or file downloads, the worm can cascade through social graphs, exploiting the trust inherent in personal contacts. The result is a potential cascade effect where a single compromised account could seed infections across thousands of contacts in a short time.

Patch Timeline and Real‑World Impact

Tencent responded by releasing patches for the vulnerability in Android version 8.0.77 and iOS version 8.0.76, effectively sealing the memory‑corruption pathway in the VoIP stack. However, the patches arrived only after the researchers demonstrated the worm, meaning devices that have not updated remain vulnerable. The lag between discovery and patch deployment is a recurring issue in mobile security, especially for platforms with massive user bases and frequent OS fragmentation.

To date, no evidence of active exploitation has been observed in the wild, suggesting that the worm remains a proof‑of‑concept rather than an operational threat. Nonetheless, the mere existence of a zero‑click, cross‑platform exploit raises alarm for enterprises that integrate WeChat into their communication workflows, as well as for individuals who rely on the app for financial transactions. The episode illustrates how a single flaw can jeopardize both personal privacy and broader economic activities tied to the platform.

What This Actually Means For You

1. Any WeChat user who has not installed the latest patches on Android or iOS remains exposed to a remote takeover that requires no interaction.
2. Contacts stored in your address book become potential attack vectors; the worm can spread silently through your social network.
3. Financial transactions conducted via WeChat, such as payments or money transfers, could be intercepted or redirected if an account is compromised.
4. Enterprise reliance on WeChat for official communications introduces a supply‑chain risk that may bypass traditional corporate security controls.
5. Even declining a suspicious call does not guarantee safety, as the attacker can simply re‑initiate the call to resume the infection cycle.

Immediate Action Steps

First, verify that your device runs WeChat version 8.0.77 on Android or 8.0.76 on iOS, and apply any newer updates immediately. Second, audit your contact list for unknown or unexpected entries, and consider removing contacts you do not recognize to limit the worm’s propagation path.

Finally, enable two‑factor authentication on your WeChat account where available, and monitor transaction logs for any unauthorized activity. While 2FA does not stop the initial account takeover, it adds a barrier to subsequent misuse of compromised credentials.

Frequently Asked Questions

How does the WeChat zero‑click worm infect a device without answering a call?

The worm exploits a memory‑corruption bug in WeChat’s VoIP stack; as soon as the phone starts ringing, the malicious payload executes, granting the attacker control without any user action.

Are there any known real‑world attacks using the WeWorm exploit?

According to the researchers, no exploitation has been observed in the wild; the worm remains a proof‑of‑concept demonstrated at a conference.

What versions of WeChat contain the patched VoIP vulnerability?

Tencent released patches in Android version 8.0.77 and iOS version 8.0.76, which close the memory‑corruption pathway used by the worm.

What Do You Think?

Given the ease with which a zero‑click worm can hijack a globally used app, should users and organizations reconsider their reliance on WeChat for critical communications and transactions?