"Exploitation takes only seconds, and gives us full control of the WeChat account," Calif said.
Calif's WeWorm demonstration: account takeover without an answer
Security researchers at Calif published a demo this week showing a zero-click worm — which they call "WeWorm" — able to take over a WeChat account in seconds simply by placing a call. In the demonstration the recipient never answered; the exploit nonetheless gave the attacker control of the victim's account, which then placed a call to another contact and repeated the process automatically. According to Calif, declining the incoming call stopped the spread, but answering it or allowing it to continue ringing did not. The researchers also noted an attacker could retry when the recipient was away from the phone.
Technical vector: VoIP memory corruption and zero-click RCE on iOS and Android
Calif says the flaw resides in WeChat's VoIP stack and is a memory corruption bug that enables remote code execution (RCE) without any user interaction. The team described WeWorm as the first zero-click worm capable of spreading through WeChat calls on both iOS and Android. In language the researchers used publicly, the exploit "gives us full control of the WeChat account" and permits actions including reading and sending messages, making calls, and acting on the victim's behalf.
Calif further warned the vulnerability need not be the end of the story: it can be chained with other bugs to move from an application compromise to device-wide control. The researchers said, "Chained with other Android and iOS bugs we've reported and are helping fix, it can lead to full control of the device," and cited techniques like those used in "OEMpocalypse" as examples for gaining root access. Calif did not disclose the full attack chain in its public materials.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTencent confirmation and patching timeline
Tencent later confirmed Calif's findings. According to the researchers, Tencent pushed fixes to address the attack on August 21. Calif is withholding key technical details while it assists with fixes and prepares a full presentation; the team told readers it plans to present the complete analysis of WeWorm "at an upcoming conference." The Register asked Tencent for additional comment.
What this means for technologists, policymakers, and end users
- Technologists and security teams: The combination of a zero-click VoIP RCE and the ability to propagate via a trusted contact underlines the danger of chained vulnerabilities. Calif said it used AI to find the vulnerability and develop a working remote code execution exploit in about two days, an observation the team published to highlight how AI can accelerate exploit development beyond "well-funded, sophisticated actors."
- Policymakers and international actors: Ryan Fedasiuk, an adjunct assistant professor in Georgetown University's Security Studies Program, described the discovery as "an extremely serious incident" and called on the US and China to maintain open communication and share information as AI increases the potential scale and severity of cyber threats.
- End users and WeChat contacts: The exploit requires the attacker to be on the victim's friends list, which Calif said offers only limited protection because a compromised account can be used to target its trusted contacts. Calif's demo shows that declining an incoming call is effective at preventing infection; answering or letting it ring is not.
Conclusion
Calif's demonstration lays out a stark technical fact: a VoIP memory-corruption bug in a popular messaging app can be weaponized to seize an account and propagate to contacts without any interaction by the target. Tencent's August 21 fixes are the immediate remedy the company states it has applied; Calif's withheld technical details and planned conference presentation mean the broader security community will likely have to wait for the complete, peer-reviewed record. Calif framed its disclosure as a warning about how AI is lowering the barrier to rapid exploit development — a point echoed by outside observers who called the incident "extremely serious." The next public milestone will be the team's full analysis at the upcoming conference, and whether similar zero-click propagation techniques appear elsewhere as researchers and attackers study the patch and the underlying bug.
