Security researchers at Calif built a worm that takes over a WeChat account simply by placing an incoming call — the target does not need to answer or touch their phone. The only requirement is that the caller is already in the target’s WeChat contact list. Calif demonstrated the attack spreading across three test devices: an Android phone called an iPhone and seized its account while it was still ringing; that compromised iPhone then called a second Android and took control of it the same way. Anyone who ignores or declines the call stops that attempt, but the attacker can call again — for example while the target is asleep.
Once the exploit runs, the attacker has full control of the WeChat account: they can read and send messages, place calls, and interact with WeChat Pay and mini-programs as the account’s owner. The app’s trust model amplifies the risk — once one contact is compromised, WeChat’s implicit trust toward that contact becomes a weapon the attacker can use to reach further contacts. Calif reported the flaw to Tencent in July; Tencent released WeChat 8.0.77 for Android and 8.0.76 for iOS on August 21, then confirmed a server-side block on August 28 that protects all users regardless of their app version. Tencent has published no public advisory or CVE identifier, and the release notes for the iOS update describe it only as “bug fixes.”
How to check if you’re affected
Affected versions are any WeChat for iOS older than 8.0.76, and any WeChat for Android older than 8.0.77. The server-side block covers all users, but running an out-of-date version leaves you exposed to any follow-on issues Tencent has not yet mitigated server-side. Open the App Store (iOS) or Google Play (Android), search for WeChat, and confirm you are on the current release. Tencent’s official release log at weixin.qq.com/updates shows 8.0.76 as the current iOS version as of September 8. Calif has stated there are no known in-the-wild attacks using this flaw.