Rentable uCreator Android Spyware Targets Telegram and WeChat Accounts

A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding code inside working copies of the two apps, researcher Ovi found. Ovi's analysis was published on October 21, 2026. It only reaches people who install tampered copies outside official app stores or who run WeChat inside the kit makers' container app, 洋葱盒子 or Onion Box. Some tampered Telegram X copies reuse the real app's package name.

The Telegram part matches Baohuo, a backdoor Doctor Web reported in October 2025. Doctor Web found Baohuo in tampered Telegram X copies and estimated more than 58,000 infected devices. It lists the same code namespace, com.ucreator.tgjar, command-and-control server and command names as Ovi's analysis. Ovi's report does not mention Doctor Web, and it is unclear whether the kit's makers or a customer ran the tracked campaign.

Telegram takeover and WeChat cloning

Inside a tampered Telegram app, the code starts with the app and runs with its identity and permissions, Ovi found. Code for each target app is downloaded after installation. Telegram's two-step verification password is entered in the app, which uses it to generate a login proof. The kit hooks that step and copies the password before hashing. With it, code can reset logged-in sessions, change the linked phone number or delete the account. It can hide the attacker's session and sends the account's phone number, name and password to its server every three minutes.

Neither Ovi nor Doctor Web says whether a hidden session appears on the user's other, untampered apps, or gives steps for securing an account. Ovi says the code shows capability, not that every step was used. For WeChat, the kit can use app virtualization, copy the login identity, zip and upload app data, and use a bundled login script to clone the account.

Ovi and researcher Jurre found the back end on a self-hosted GitLab server. It carries a cloud console that merchants and resellers rent. Every command carries a customer ID, so each customer targets victims with its share of a phone fleet. The kit captures login authorizations, adds friends in bulk, collects contact and profile data, and backs up accounts. A scheduler sets time windows, random daily limits and per-account budgets so activity looks human, which the code calls account cultivation. The leaked back end covers personal WeChat and WeCom, not Telegram, and only one of several GitLab servers was exposed.

Attribution and indicators

Ovi ties parts of the operation to three Hunan province companies, linked to the brand website and a server certificate, a government website filing for a command server, and the signature on the Windows control program. He says a shared owner is plausible but unproven. The product name is YingGai, and records date back to September 2021. The samples studied date from 2024 to July 2026. Ovi assumes financially motivated crime, given the focus on wallets and one-time passcodes. Doctor Web described Baohuo as a tool for boosting Telegram channel subscribers.

Ovi calls two phone traces reliable: TgJarPine.dex in tampered Telegram assets, and the original app copy the LSPatch patcher leaves at cache/lspatch/origin/*.apk, which can also appear in apps patched for other reasons. By October 23, 2026, several kit server and download domains no longer resolved. The version-upload domain still pointed to 121.37.194[.]194.

Sources: The Hacker News