A dangerous Android spyware toolkit known as uCreator is actively compromising Telegram and WeChat accounts, enabling attackers to harvest two-step verification (2FA) passwords from Telegram, fully clone WeChat logins, and stealthily maintain control over victims’ devices. The malware is spread via modified app copies outside official stores or through a custom “container” app that runs targeted apps inside itself.
What Is uCreator and Where It Comes From
uCreator is a rent-or-use spyware kit, brand-named YingGai by its makers. It injects malicious code into functioning versions of Telegram and WeChat (and potentially many other messaging, wallet, or social apps). Researchers traced connections between uCreator’s Telegram module and the Baohuo backdoor, previously uncovered in modified Telegram X apps in 2025, noting shared customer control servers, identical command names, and the same code namespace.
The operation’s roots appear tied to several companies based in China’s Hunan province. Code samples date back to 2024, with YingGai’s internal records going as far as September 2021. The infrastructure includes a cloud-console backend that allows customers to target victim fleets, set activity schedules, and carry out “account cultivation” with features aimed at making compromised behavior appear normal.
How the Attack Works and Who’s at Risk
The attack installs a modified version of Telegram or WeChat via sideloaded APKs or through a container app called 洋葱盒子 (“Onion Box”) that hosts the legitimate app inside. In many cases, the tampered Telegram apps retain the official app’s package name, making detection harder. For Telegram, once the virus-infected version is active, it intercepts the 2FA password at the moment it’s entered — before the app hashes it — enabling account takeover, phone-number change, forced logouts, or even deletion of the original account. Hidden attacker sessions aren’t shown in the victim’s device list.
WeChat compromise works differently: the victim’s login identity is snatched, account data zipped, and the account cloned using bundled login scripts. The campaign seems to target users of mobile wallets, messaging apps, and social networks in China and Southeast Asia. Apps like WeCom, QQ, WhatsApp, LINE, and others are listed as possible targets though only Telegram and WeChat are confirmed so far.
Technical Impact and Defenses
A proof check was done using a Pixel 10 Pro running Android 17. The spyware’s “hooking engine” failed to find a certain Android internal function that was changed in newer versions. This suggests newer Android versions may complicate—or slow—this kind of attack, but do not fully prevent it. Tools like Frida, however, could still enable the hooking behavior.
Reliable indicators of compromise are available: modified Telegram app copies often include a file called ‘TgJarPine.dex’ inside app assets, or show evidence of LSPatch’s original APK in cache directories. Some server and download domains tied to uCreator had already become inactive as of late October 2026, though others—particularly those used for version uploads—were still valid.
What This Means and What to Watch Next
uCreator is more than just another Android malware variant—it’s a commercial spyware service that gives customers modular control over attacks. Rather than relying solely on mass phishing or zero-day exploits, it customizes attacks through tampered apps, containerization, and backend tools for scale. The overlap with Baohuo indicates the threat has been active and evolving since at least mid-2024, especially in Brazil, India, Indonesia and other regions.
For users: sticking to official app stores, scrutinizing app signatures, and enabling Android’s built-in protections (Google Play Protect, signature verification) are better defenses than ever. For platforms: spotting hidden sessions, abnormal account switches or phone-number changes in Telegram or WeChat could tip off breaches. Researchers and defenders now have IOCs (SHA-256 hashes, domain/IP details) to help identify compromised installations.
uCreator represents a wake-up call: spyware is no longer just about remote exploits—it’s now a service economy with rented kits, modular payloads, and stealth operations targeting not only your messages, but your identity. Watch for further breaches in messaging and finance apps as this toolkit expands its reach. Our digital identity systems must adapt quickly—threat detection, code signing, and user vigilance will need to outpace these evolving attacks.
