Security researchers built a zero-click worm that hijacks WeChat accounts through an incoming voice call on both iPhone and Android, without the target ever answering. The exploit fires during the ringing phase, before the user declines or picks up, abusing a memory-corruption flaw in WeChat's call-handling code to run commands on the device and take over the account. Because it can spread from a compromised contact to their contacts, it behaves like a worm. Notably, the researchers used AI to find the bug and write the exploit in about two days. Tencent patched it in late August and added a server-side mitigation, and saw no in-the-wild abuse before the fix.
Italian digital forensics firm Forenser has documented an active zero-click WhatsApp account-takeover campaign targeting iPhone users on iOS 16. Victims (iPhone 8 through 14) reported messages requesting wire transfers being sent from their accounts to recent contacts, with no Linked Devices entries and no QR code interaction. Unified-log analysis shows continuous WhatsApp session-resync events - the signature of two endpoints competing for the same account, with the attacker bypassing the standard linked-device registration. The campaign exploits known iOS 16 vulnerabilities. Affected users do not see archived chats, suggesting the attacker has only recent-chat access. Forenser recommends upgrading to iOS 17 or later.
TrustStrike Labs