A security research firm has published a demonstration showing that a flaw in WeChat’s calling code was enough to hand an outsider control of someone’s account before that person ever picked up the phone. The firm, Calif, reported the flaw to WeChat’s owner Tencent in July, and Tencent has since shipped app updates and a server-side block that shut the technique down for every user. No real-world attacks using it have been reported.
A demonstration worm that hopped between three phones
Calif built its proof of concept, which it calls WeWorm, on three handsets. An Android phone placed a call to an iPhone and took over the iPhone’s WeChat account while the screen was still showing an incoming call. The compromised iPhone was then used to call a third phone, an Android device, and did the same thing to it. Each victim became the next attacker, which is what makes the demonstration a worm rather than a single break-in.
Once inside an account, the researchers say the takeover gave them the ability to read and send messages, place calls, and act as the account holder. The whole sequence took seconds. The person on the receiving end did not have to answer, and would have heard nothing unusual if they did. Declining the call within a few seconds stopped that particular attempt, but nothing prevented the caller from trying again later, including while the target was asleep.
The flaw sat in WeChat’s calling code
Calif has described the underlying problem only in general terms: a memory-corruption issue in the part of WeChat that handles voice and video calls. That component runs automatically to process an incoming call, which is why no tap from the recipient was needed. The firm has said it is holding back the technical write-up until it can present a full analysis at a conference, and until related work with other messaging apps and platform owners is further along.
That restraint is conventional practice for this kind of disclosure. The class of bug is not exotic; what made this one significant was where it lived. Call-handling code is one of the few parts of a messaging app that will process data from another party without any decision by the user, which is what turns an ordinary memory bug into a so-called zero-click attack.
Reaching a target required going through a friend first
One limit was built into the technique from the start: the calling account had to already be on the target’s WeChat contact list. On its own that narrows the pool considerably. In a worm, though, it stops being much of a barrier, because each account the worm takes over comes with its own contact list, and everyone on it is reachable. Calif framed the design flaw plainly, noting that messaging apps grant trusted contacts extra privileges, and that once a single contact falls, that trust runs the wrong way.
The firm also pointed out that an attacker with other capabilities would not need to wait for the worm to reach a target by chance. Separate research the same team published in August described a route from an untrusted Android app to root access, which would offer another way onto a first device in the chain.
Six weeks from a July report to a server-side block
Calif’s published timeline puts the discovery in July, with its engineering team confirming the bug on 23 July and reporting it to Tencent the following day. The researchers finished a working exploit for Android on 30 July and for iOS on 2 August, and had the polished cross-platform worm demonstration running by 11 August.
Tencent published WeChat 8.0.77 for Android and 8.0.76 for iOS on 21 August, which mitigated the bug in the app itself. On 28 August, Calif confirmed that its exploit was also blocked on Tencent’s servers, meaning users who had not updated were covered as well. Calif shared its technical analysis and working code with Tencent on 3 September, and Tencent confirmed the following day that the vulnerability could be used for remote command execution. The research went public on 8 September, alongside coverage noting that WeChat users need to take no action of their own to be protected.
AI wrote the first working exploit in about two days
The detail Calif chose to lead with was not the bug but the speed. Working with AI tools, the team said, it found the flaw and produced a first remote-code-execution exploit in roughly two days, then spent another week turning that into a self-spreading demonstration. The firm’s own framing is that a worm of this reach would previously have taken a larger team months, and that the human contribution was mostly judgment about what to target and how to test it without causing harm.
Calif argued against reading that as a case for slowing AI development, on the grounds that the vulnerabilities already exist and that faster discovery favours whoever is looking for them in good faith. It also raised the scenario that worries defenders most: not a deliberate release, but a half-finished tool escaping a lab, the way the leaked tooling behind WannaCry did before it reached hospitals.
What the episode says about a billion-user app
WeChat’s scale is the reason the finding drew attention beyond the security trade press. The app functions as messenger, payment system, social network and gateway to shopping, transport and government services for more than a billion people, overwhelmingly in China. An account takeover there is not the loss of a chat history; it is access to the tools someone uses to move money and prove who they are.
The outcome was the one the disclosure process is designed to produce — a fix in place before any attacker is known to have found the same door, and a fix that reached users passively rather than depending on them to update. What the researchers are pressing on is whether that timeline holds when the same tools are pointed at the next app, and by someone with no interest in reporting what they find. Calif has said it is continuing the work across other messaging platforms, with attention on the same class of automatic, no-interaction attack surface.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
