WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls
- ID
- 22378
- Status
- summarized
- Published
- 08 Sep 2026, 7:54 PM
- Fetched
- 08 Sep 2026, 10:15 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/wechat-zero-click-worm-took-over.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.0
- Created
- 08 Sep 2026, 10:18 PM
- Tags
- Audience
- developerssaas_startup_founders
What happened
Security firm Calif built a zero-click worm that takes over WeChat accounts via incoming calls—no answer required—demonstrating it spreading across three test phones (Android to iPhone to Android). The caller must be an existing WeChat contact, but once one contact is compromised, the trust WeChat grants contacts turns the worm self-propagating. Tencent patched the flaw in versions 8.0.77 (Android) and 8.0.76 (iOS) released 21 August, and confirmed server-side blocking on 28 August; no real-world attacks were reported.
Why it matters
WeChat's 1.439 billion users include many in Malaysia and SEA who use it for payments, mini programs, and business with China—the exploit gave full account control (messages, calls, payments) without touching the phone OS. If you or your customers use WeChat for commerce, confirm devices are updated past 8.0.77/8.0.76 and treat contact-list trust as a propagation risk when designing social-graph-based features in your own apps.
Discussion angle
The worm's design—abusing the implicit trust that messaging apps give to existing contacts—is a pattern worth discussing for anyone building social-graph features, referral systems, or contact-based permissions in their own products.