Rentable Android spyware kit uCreator uses tampered Telegram apps and a WeChat container to capture credentials and clone accounts.

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps   deepveindrilling.com: Magento CMS block loader hits 953 stores   CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC […]

Rentable Android spyware kit uCreator uses tampered Telegram apps and a WeChat container to capture credentials and clone accounts.

Rentable Android spyware kit uCreator uses tampered Telegram apps and a WeChat container to capture credentials and clone accounts.

 A commercial Android surveillance toolkit known as uCreator can compromise Telegram accounts by capturing two-factor authentication (2FA) passwords and duplicate WeChat accounts through malicious app modifications, according to security researcher Ovi. The toolkit reaches users through tampered applications distributed outside official app stores or through a container app that allows WeChat to operate within a separate environment.  The toolkit’s Telegram component shares several technical characteristics with Baohuo, an Android backdoor documented by Doctor Web in October 2025. That investigation estimated that more than 58,000 devices had been infected. Both analyses identified the same code namespace, command-and-control server and command names.  However, researchers have not established whether the operators behind the two investigations are the same. The malicious applications can execute code under the identity and permissions of the original apps, giving the spyware access to their data and internal functions. Target-specific modules are downloaded after installation, making the initial application package less revealing during security analysis. Ovi identified code supporting around 20 applications, including messaging platforms and mobile financial services, but published detailed technical findings for Telegram and WeChat.  For Telegram, the spyware can query the application’s message database to extract conversation histories. It also intercepts the login process to capture the user’s 2FA password before the application hashes it. With access to this information, an attacker could reset existing sessions, change the account’s linked phone number or delete the account. Additional functions can conceal an intruder’s session and interfere with the owner’s ability to recover access.  The WeChat module uses virtualization to run the legitimate application inside the toolkit’s own container. It can extract account identity information, package application data into an archive and upload it, while a bundled script helps reproduce the account. Ovi and fellow researcher Jurre also uncovered backend source code on an exposed GitLab server. The code describes a cloud-based control platform rented by merchants and resellers, with commands assigned to individual customers.  Its capabilities include capturing login authorizations, collecting contact and profile information, adding friends in bulk and backing up accounts. Scheduling controls establish operating windows and randomized activity limits intended to make the behavior appear more natural and avoid platform security checks. The product is known to its developers as YingGai, and records of the product line date to September 2021. Ovi linked elements of the operation to three companies in China’s Hunan province, although he cautioned that common ownership has not been proven. Some developers appeared to be making changes as recently as October 2026.  Testing on a Pixel 10 Pro running Android 17 showed that the toolkit’s hooking engine could not locate an internal function it relied on. However, another tool could still intercept application functions, meaning the result does not demonstrate that Android 17 prevents the attack. Potential infection indicators include a file named TgJarPine.dex in some modified Telegram applications and original APK files retained by the LSPatch tool.  Several associated command and download domains were no longer resolving on October 23, 2026, although the version-upload domain still pointed to an active IP address. Ovi stressed that his findings describe the toolkit’s technical capabilities rather than establish how many people have been affected. The research highlights the risks of installing modified messaging apps from untrusted sources, particularly when they can expose credentials and enable account takeover.

Groups Conversations All groups and messages Sign in Technical - Malware Conversations About Privacy • Terms     uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps 0 views Skip to first unread message Eyal Estrin unread, 12:53 AM (1 hour ago)    to https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/ https://vms.drweb.com/virus/?i=30931101&lng=en Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

Telegramの2段階認証はアカウントへの不正アクセスを防ぐための仕組みですが、市販のAndroid向けスパイウェアキットを使えば、その保護に使われるパスワードを傍受できてしまいます。「uCreator」と呼ばれるこのスパイウェアは、Telegram Xをはじめとする正規のAndroidアプリを改変し、その内部に

A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the kit makers' own container app. The kit's Telegram part matches Baohuo, a backdoor that Doctor

Plataforma uCreator é vendida a criminosos para invadir contas e driblar segurança de aplicativos

Researchers found the rentable uCreator Android kit can steal Telegram 2FA passwords and clone WeChat accounts through tampered apps or a container. Its code…

Analyse technique publiée le 21 octobre 2026 sur le blog 0x0v1 par le chercheur Ovi, portant sur uCreator (nom interne vendeur : YingGai), une plateforme commerciale de surveillance Android de type « mass control » (群控), active depuis au moins 2014 et toujours en développement actif en 2026.

A commercial Android spyware kit called uCreator can steal Telegram credentials, hijack WeChat accounts, and collect sensitive data through modified apps.

Android users who installed unofficial Telegram or WeChat apps should remove them and secure their accounts against uCreator spyware.

Haz clic para acceder al contenido completo.