Tencent confirms server-side block after WeChat zero-click worm test

Researchers at Calif say a controlled test showed how an incoming WeChat call could compromise an account without the recipient answering, then allow a worm to move between Android and iOS devices. Tencent has since deployed a server-side protection, which it says requires no user action, and says it has found no evidence of exploitation in the wild.

Security research company Calif disclosed the proof of concept, named WeWorm, on 8 September 2026. Its public demonstration used three researcher-controlled phones and showed the attack passing from an Android device to an iPhone, then from that iPhone to a second Android device.

The findings describe a potentially serious attack surface in the way WeChat processes incoming voice calls. They do not establish that a worm escaped the laboratory, compromised real accounts or affected the full population covered by Tencent’s combined Weixin and WeChat activity metric.

A call that did not need to be answered

According to Calif, the attack could begin when a target received a WeChat call from an existing contact. The recipient did not need to answer because vulnerable call-handling code processed the incoming communication before that point.

Calif attributes the behaviour to a memory-corruption vulnerability in WeChat’s VoIP call-handling stack. Calif says the flaw could enable remote command execution, but it has withheld the weakness subtype, precise vulnerable component and other technical details. It has also withheld exploit code and reproducible attack instructions.

Calif says successful exploitation in its demonstration gave the worm control of the target’s WeChat account, including the ability to read and send messages, make calls, impersonate the user and continue propagating through trusted contacts.

In Calif’s account, that contact-based movement is what made the experiment a worm rather than a single account takeover. Once one controlled account was affected, the proof of concept used its trusted position to call another contact and continue the chain without that person answering.

The public evidence nevertheless has clear limits. Calif released demonstration videos and a high-level explanation, not the technical material needed for others to reproduce its work. Its account-control claims are partly supported by the demonstration, but the full mechanics remain unavailable for independent scrutiny.

The WeChat flaw alone also did not establish full control of an Android phone or iPhone. Calif says device compromise would require the exploit to be combined with separate Android or iOS vulnerabilities it has reported elsewhere. Those additional chains remain undisclosed, so account takeover and complete device takeover should not be treated as equivalent outcomes.

Two tested builds, not a complete affected range

Calif identified WeChat 8.0.76 for Android and WeChat 8.0.75 for iOS as the builds used in successful testing. Those two results do not define the complete range of affected versions.

Tencent released WeChat 8.0.77 for Android and 8.0.76 for iOS on 21 August. Calif says those releases mitigated the bug. By 28 August, the researchers had also confirmed that the demonstrated exploit had been blocked server-side for all users.

A Tencent spokesperson subsequently confirmed the server-side protection to the South China Morning Post, saying it required no user action. No temporary user-side workaround has been prescribed.

The available evidence supports describing these measures as mitigation, rather than a confirmed root-cause repair. Calif did not confirm to The Hacker News whether Tencent had removed the underlying memory-corruption flaw, and no issue-specific Tencent technical advisory had been located in the reviewed sources by the 9 September evidence cutoff.

The distinction matters because blocking the demonstrated exploit path and correcting vulnerable client code are different remediation outcomes. The public record identifies the mitigating client releases and server-side block, but does not establish whether the underlying flaw was removed from either tested client.

Disclosure unfolded over seven weeks

Calif’s timeline begins on 23 July, when its engineering team became aware of what it describes as an AI-identified vulnerability. The researchers submitted the issue to Tencent the following day.

The company completed an initial Android remote-command-execution demonstration on 30 July and an iOS version on 2 August. A polished three-device worm demonstration was completed on 11 August, followed by the mitigating Android and iOS releases on 21 August and confirmation of the server-side block one week later.

Calif supplied Tencent with its technical analysis and working exploits on 3 September. According to the researchers, Tencent confirmed the next day that the vulnerability could support remote command execution. Calif published its research and videos on 8 September.

On 9 September, the South China Morning Post reported Tencent’s confirmation of the server-side fix and the company’s assessment that it had no evidence of real-world exploitation. There has been no confirmed production outage, fraud, data theft or unauthorised access connected to WeWorm. No malicious threat actor or campaign has been identified.

The AI claim needs qualification

Calif says its researchers worked with AI to find the vulnerability and produce its first remote-code-execution exploit in about two days, before spending another week building the worm. The company has not disclosed the model, its precise contribution or enough information to reproduce that claimed development speed.

The research should not be characterised as wholly autonomous AI work. Calif says humans selected targets, exercised judgement and supervised testing. The available account therefore describes AI-assisted vulnerability research and exploit development, with people still directing and controlling the work.

There is also an unexplained difference between the claimed two days of work and the published calendar. Calif’s timeline runs from awareness of the vulnerability on 23 July to completion of the Android demonstration on 30 July and the iOS demonstration on 2 August. The two-day figure may refer to working time rather than elapsed time, but Calif has not explained the discrepancy.

A large service does not equal a billion vulnerable accounts

Tencent reported more than 1.4 billion combined monthly active Weixin and WeChat users at the end of the first quarter of 2026. That is an activity metric spanning two sister services, not a count of unique phones, vulnerable installations or compromised accounts.

The applicability of the research to Weixin-branded clients has not been established. Nor is there evidence covering HarmonyOS, Windows, macOS or Linux clients. With only two tested mobile builds publicly identified, the number of installations that were exposed before mitigation remains unknown.

Australia has some direct, although currently limited, relevance because WeChat is available and used in the country. In information lodged with an Australian parliamentary inquiry, Tencent said WeChat had fewer than 500,000 daily active Australian users as of July 2023 and estimated that several hundred thousand Weixin users might also be present. Those figures are historical and should not be read as current usage data.

No Australian targeting or victims have been reported. More broadly, the absence of known exploitation rests on Tencent’s stated evidence and the lack of contrary credible reporting, rather than independently available exploitation telemetry.

Several technical and operational questions remain open. No CVE identifier, CVSS score, detailed weakness classification, detection indicators or user-facing method for checking whether an account previously received a malicious call had been published by the evidence cutoff.

Calif’s full analysis and planned conference presentation were not yet public. Without further technical disclosure or an issue-specific Tencent advisory, the complete affected-version range and whether the underlying client flaw was removed remain unresolved.

Distinguishing a blocked exploit path from removal of an underlying flaw sharpens the way vulnerability research is assessed. For further study, The Hack Academy’s online cybersecurity training programme combines self-paced learning with practical exercises alongside theory, and lists internet vulnerabilities and penetration testing among its subjects; all testing must remain authorised and controlled.