A WeChat worm demo took over iPhone and Android accounts through incoming calls from existing contacts; Calif says Tencent blocked the exploit.