WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

Summary: Researchers at the security firm Calif built a worm that takes over a WeChat account through an incoming call the target never has to answer, and demonstrated it spreading across three test phones, with one Android phone compromising an iPhone while it was still ringing and that iPhone then compromising a second Android phone. Calif reported the flaw to Tencent in July, and Tencent released WeChat 8.0.77 for Android and 8.0.76 for iOS on 21 August and blocked the exploit on its servers by 28 August, though it has published no advisory and no CVE identifier exists.
Why it matters: The caller only needs to already be in the target's WeChat contacts, and once one account falls the trust WeChat extends to contacts carries the attack onward, so a single compromised contact becomes the entry point to everyone they know. Tencent's block runs server-side and requires no user action, but with no advisory, no CVE, and no way to tell whether you were called, defenders on HarmonyOS, Windows, Mac, and Linux clients have nothing to check against.

Read the original at The Hacker News ↗