uCreator Spyware Targets Telegram, WeChat Accounts

Mobile users of Telegram and WeChat risk full account takeover or cloning if they install tampered app copies distributed outside official stores or run WeChat inside a third-party container, according to an analysis of a rentable Android spyware kit called uCreator.

How uCreator embeds into Telegram and WeChat

Researcher Ovi found that uCreator hides its code inside working copies of Telegram and WeChat so the malicious code runs with the app’s own identity and permissions. Some tampered Telegram X copies use the same package name as the real app on Google Play, so the package name alone may not reveal the modification. The kit also offers an alternative delivery: a container app called 洋葱盒子 ("Onion Box") that runs other apps inside itself, enabling virtualization of unchanged apps while the kit extracts data.

Telegram account takeover: two-step verification and hidden sessions

Inside a tampered Telegram app, the kit downloads additional code after installation and runs a local command server. Ovi found the kit can intercept database queries to extract chat history and, critically, hook the two-step verification (2FA) password entry. The kit copies the 2FA password in readable form before the app hashes it, enabling an attacker to reset logged-in sessions, change the linked phone number, delete the account, or otherwise keep an attacker session active while locking out the owner. The backdoor can also hide the attacker’s session from the tampered app’s device list; Doctor Web’s description of the Baohuo backdoor covers the same device-hiding behavior and reports the backdoor sends the account phone number, name and password to its server every three minutes.

WeChat cloning, the leaked back end, and automated “account cultivation”

For WeChat, uCreator can virtualize the app inside its own container, copy out the account’s login identity, zip and upload the app data, and use a bundled login script to clone the account. Ovi and another researcher named Jurre also found the kit’s back-end code on a self-hosted GitLab server; that leaked back end shows a cloud console merchants and resellers rent. Every command carries a customer ID so individual customers aim their allocated phones at chosen victims. Commands go both to a controlled phone farm and to victims’ phones to capture login authorizations, add friends in bulk, collect contact and profile data, and back up whole accounts. The back end includes a scheduler that sets time windows, random daily limits, and per-account budgets so activity looks human and can pass platform risk checks — a practice the leaked code labels "account cultivation."

Distribution, scope and indicators of compromise

Ovi attributes infection vectors to sideloading and social engineering; Doctor Web previously documented Baohuo spreading since mid-2024 via in-app ads linking to fake app stores that promoted Telegram X as a dating and video chat app. Baohuo copies were also found on third-party stores APKPure, ApkSum and AndroidP. Doctor Web’s 2025 map placed India first at 22.8% of infections, followed by Brazil at 20.5% and Indonesia at 9.6%; Doctor Web and Ovi both observed activity affecting China and the United States, though Ovi emphasized his report is "an analysis of technical capability, not a measurement of victim impact."

Ovi published a set of reliable traces the kit leaves on a phone: a code file named TgJarPine.dex in some tampered Telegram copies, and an original app copy left by the LSPatch tool at cache/lspatch/origin/*.apk. The Hacker News also published multiple indicators Ovi identified, including SHA-256 hashes, domains, and IP addresses. Examples include:

• SHA-256: 2fc4bad71eda25b9022ea7cb090d6419911ecd67e50e746b418f8a617a980301 (com.ucreator.tg)
• SHA-256: f82ac2c525d1ed82e57b3f27ae689aeda46875a893ca4c42876b3166ba66bb20 (com.ucreator.va_vx, WeChat host)
• Domain: hw.android.videoflow[.]cn (version uploads, pointed to 121.37.194[.]194 on October 23, 2026)
• URL: kfpt.oss-cn-hangzhou.aliyuncs[.]com/android/app/YingGai/ (hook downloads)

What this means for security teams, Telegram, and WeChat

Security teams should treat these findings as a technical capabilities brief rather than a quantified incident report: Ovi explicitly framed his work as showing what the kit can do, not proving each step has been used against victims. Teams responsible for mobile defenses will note the two operational angles—tampered app binaries and app virtualization inside a container—both of which let attacker code inherit app privileges.

Telegram and WeChat operators face different pressures. Telegram’s previously reported Baohuo campaign included device-hiding behavior and mass exfiltration of account identifiers, while WeChat-focused modules aim to clone account logins and harvest account-level data. Both platforms will need to weigh detection of the artifacts Ovi lists (forensics traces like TgJarPine.dex and LSPatch remnants) and platform-side signals from bulk friend adds, scheduled activity patterns, and anomalous session operations.

Ovi links parts of the operation to three companies in Hunan province, China, and notes the product name YingGai appears in records back to September 2021; he assumes the kit is primarily used for financially motivated crime given its focus on wallets and one-time passcodes. Doctor Web described Baohuo as "a tool for boosting the number of subscribers in Telegram channels." The record ends on a concrete — and uncomfortable — technical point: the kit is a rentable product with a leaked control back end, active developer commits as recently as October 2026, and a phone farm and scheduler built to make automated abuse appear human.

https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html