WeWorm Zero-Click Worm Exploits WeChat Calls on iOS and Android

WeWorm is a proof‑of‑concept zero‑click worm that spreads through WeChat voice calls on both iOS and Android, compromising a target's WeChat account in seconds without any user interaction, and it demonstrates a previously unseen cross‑platform attack vector that threatens millions of mobile users.

What is WeWorm and how does it work?

Researchers disclosed a memory‑corruption flaw in WeChat's Voice‑over‑IP (VoIP) stack that can be triggered by a specially crafted call packet. The flaw allows arbitrary code execution on the device before the user ever picks up the call, which the researchers turned into a worm that automatically propagates to the next contact in the victim's address book.

The worm is “zero‑click” because it requires no user action – the malicious payload is delivered the instant the call is received. Once executed, the worm extracts the victim's authentication tokens, logs into the WeChat service, and places outbound calls to the victim's contacts, repeating the cycle.

Which devices and users are at risk?

The proof‑of‑concept works on both iOS and Android versions of the WeChat client, meaning the attack surface spans the two dominant mobile operating systems. Any user who has WeChat installed and receives a call from a compromised contact is potentially vulnerable, regardless of whether they have a jail‑broken or rooted device.

Because WeChat is one of the most popular messaging apps in China and among diaspora communities worldwide, the pool of at‑risk users runs into the hundreds of millions.

How did researchers discover the vulnerability?

The team performed fuzz testing on the WeChat VoIP component, injecting malformed SIP packets until the application crashed. Reverse‑engineering the crash dump revealed a heap‑overflow that overwrote function pointers, which they then leveraged to achieve code execution.

After confirming the exploit on a lab device, the researchers built a worm that automatically harvested credentials and propagated via the app’s own call‑routing logic, demonstrating a full‑chain attack.

What can developers and platform owners do to mitigate?

First, the WeChat development team should issue a patch that adds strict bounds checking on all inbound VoIP packets and isolates the call‑handling process using sandboxing techniques. Apple and Google can also harden their media‑framework layers to detect and block malformed payloads before they reach the app.

• Input validation: Ensure all network data is validated against protocol specifications.
• Process isolation: Run VoIP handling in a separate, low‑privilege process.
• Security‑oriented testing: Incorporate fuzzing of real‑time communication stacks into the CI pipeline.
• Rapid update distribution: Leverage app‑store mechanisms to push patches quickly to users.

What steps should end‑users take right now?

Users should update WeChat to the latest version as soon as a security update is released. If an update is not yet available, consider temporarily disabling the VoIP feature or blocking incoming calls from unknown numbers.

Enabling two‑factor authentication (2FA) on the WeChat account adds a layer of defense, because the worm only captures session tokens, not the second factor. Regularly review logged‑in devices in the WeChat security settings and revoke any that look unfamiliar.

What does this mean for the broader mobile threat landscape?

WeWorm proves that zero‑click exploits are no longer confined to high‑value targets like diplomatic phones; they can be packaged into mass‑distributable malware that leverages everyday communication apps. The cross‑platform nature of the bug also signals that attackers are focusing on shared codebases and libraries that span iOS and Android.

For security teams, this underscores the importance of continuous attack‑surface monitoring, especially for popular third‑party SDKs and communication stacks. Automated scanning tools that flag memory‑corruption patterns in mobile binaries can help surface similar weaknesses before they are weaponized.

What this means for you

Stay vigilant: keep your messaging apps updated, enable 2FA, and consider limiting VoIP permissions if you cannot patch immediately. For organizations that rely on WeChat for business communications, enforce device‑management policies that push critical updates and monitor for anomalous call activity. Proactive scanning of your mobile app ecosystem can catch similar vulnerabilities early, reducing the risk of a worm‑like outbreak.

Frequently asked questions

Can I protect my WeChat account without waiting for a patch?

Yes – enable two‑factor authentication, regularly review logged‑in devices, and temporarily disable the VoIP call feature if possible. These steps limit the worm’s ability to hijack sessions even before a software fix is released.

Is the WeWorm attack limited to China or does it affect global users?

The worm exploits a flaw in the WeChat client itself, which is used worldwide. Any user with the vulnerable version of the app, regardless of location, could be targeted.

Do iOS and Android devices need to be jail‑broken or rooted for the worm to work?

No. The proof‑of‑concept runs on stock iOS and Android installations, demonstrating that the vulnerability does not require elevated privileges.

How can security teams detect a WeWorm infection in their network?

Monitor for sudden spikes in outbound WeChat call traffic from a single device, and look for multiple new device sessions appearing in user account logs. Network‑level intrusion detection systems can also flag malformed SIP packets characteristic of the exploit.

Will future zero‑click attacks always target messaging apps?

Messaging apps are attractive because they have direct access to real‑time communication channels, but zero‑click techniques can be applied to any service that processes unsolicited data, such as email, push notifications, or Bluetooth connections.