WeChat Flaw Allows Account Takeover Through Incoming Calls
Calif researchers built a worm that hijacks WeChat accounts via an incoming call. The target's phone doesn't need to be touched.
Key points
- Researchers at Calif built a worm that takes over WeChat accounts through an incoming call, with no interaction required from the target.
- The caller must already be one of the target's WeChat contacts.
- Calif demonstrated the worm spreading across three test phones.
- Tencent was notified in July 2023 and is working on a fix.
How does this vulnerability work?
Researchers at the security firm Calif built a worm that hijacks a WeChat account the moment an incoming call arrives. The target doesn't answer, doesn't unlock their screen, doesn't touch anything. The one constraint: whoever places the call must already appear in the target's WeChat contacts. Calif proved the concept by watching the worm propagate across three test phones in a controlled environment.
Account takeover via zero-click exploit, where the victim needs to do nothing at all, is among the nastiest classes of mobile vulnerability. Most social-engineering attacks need a tap or a click; this one needs neither. The practical risk is narrowed by the contacts requirement, but anyone already in your list is a viable launch point.
Calif reported the flaw to Tencent, the company behind WeChat, in July 2023. Tencent has since been working on a patch.
Should users be worried?
The contacts-only trigger is a real ceiling on exposure: a stranger cannot cold-call you into losing your account. That said, your contacts list almost certainly includes people whose own devices could be compromised, which makes the ceiling lower than it first looks. WeChat's user base runs to the hundreds of millions, so even a constrained exploit at this scale is worth taking seriously.
For context on how quickly these vulnerabilities draw active exploitation: when we covered a critical Adobe Commerce flaw on 12 August 2026, live probing had already started before most users had seen the advisory. Zero-click bugs tend to attract the same urgency.
What should WeChat users do?
Keep WeChat updated. The moment Tencent ships a patch, install it. Beyond that, trim your contacts list to people you actually know: every entry is a potential call origin. Check which permissions WeChat holds on your device and revoke anything that isn't necessary for the features you use.
The harder truth is that no user-side action fully closes a zero-click hole. The fix has to come from Tencent.
