WeChat zero-click worm via incoming contact call (Calif lab demo; Tencent patched)
Calif (8 September 2026) built a demo worm, WeWorm, that takes over a WeChat account through an incoming call and spread it across three test phones on Android and iOS; simply by calling a victim, it can hijack the account and call the victim's friends. The victim does not need to answer the call or touch the phone.
Calif reported the bug to Tencent in July; Tencent published Android 8.0.77 and iOS 8.0.76, which mitigated it, on 21 August, and Calif confirmed on 28 August that its exploit was mitigated on the server side for all users.
Update WeChat from official stores and confirm the installed build is current. (source: Calif)
Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Calif)
- Product
- Tencent WeChat (iOS / Android clients in Calif demo)
- Versions
- Mitigated in WeChat for Android 8.0.77 and iOS 8.0.76 (published 21 August 2026, per Calif); Calif says Tencent mitigated its exploit server-side for all users by 28 August
- Exploited in Australia?
- unknown
- Patch to
- Update WeChat from official stores; restrict contact requests; watch for unexpected account activity after missed calls from contacts
- Primary: Calif — WeWorm (8 Sep 2026)