uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts
A rentable Android spyware kit called uCreator can steal Telegram two-factor authentication passwords and clone WeChat accounts by hiding malicious code inside tampered versions of these popular apps.
The uCreator spyware kit, discovered by researcher Ovi, operates by embedding its malicious code within functional copies of Telegram and WeChat apps. Once installed, the spyware can intercept Telegram's two-factor authentication passwords and clone entire WeChat accounts. The kit's Telegram component closely resembles Baohuo, a backdoor that Doctor Web first reported in October 2025, which had infected over 58,000 devices at the time.
Infection Methods
The spyware spreads primarily through sideloading apps outside official stores and through social engineering tactics. Some tampered Telegram X copies use identical package names to the legitimate app on Google Play, making them difficult to detect. Another infection route is through the kit makers' own container app called 洋葱盒子 ("Onion Box"), which runs other apps within itself.
Doctor Web found that Baohuo copies had been spreading since mid-2024 through in-app ads directing users to fake app store sites promoting Telegram X as a dating and video chat app. Despite the ads being available only in Portuguese and Indonesian for users in Brazil, the largest number of infected devices were in India (22.8%), followed by Brazil (20.5%) and Indonesia (9.6%).
Account Takeover Mechanism
Once installed, the spyware runs with the same permissions as the legitimate app. For Telegram, it hooks the two-factor authentication process, capturing the password in readable form before the app hashes it. This allows attackers to reset sessions, change linked phone numbers, or delete the account. The code can also hide the attacker's session from the device list shown to the user.
The kit's hooking engine is the part that lets its code intercept an app's functions. Ovi checked it on a Pixel 10 Pro running Android 17. It could not find an internal Android function it relies on, because newer Android versions changed that function.
WeChat Operation and Infrastructure
For WeChat, the spyware uses app virtualization to run the legitimate app within its own container. It then copies the account's login identity, zips the app's data, and uploads it while using a bundled login script to clone the account. Researchers also discovered the back-end code behind the operation on a self-hosted GitLab server, revealing a cloud console that merchants and resellers rent to control the spyware.
The infrastructure includes a "phone farm" of controlled devices and a scheduler that sets time windows and limits to make the activity appear human and bypass platform security checks. About three dozen developers, working on China time, appear in the code's history, with some still making changes as recently as October 2026.
Origins and Detection
Ovi links parts of the operation to three companies in Hunan province, China, though a shared owner remains "plausible, but unproven." The product, named YingGai, appears in records dating back to September 2021. The spyware leaves two reliable traces on infected devices: a code file called TgJarPine.dex in some tampered Telegram copies, and the original app copy left by LSPatch, a patching tool.
When checked on October 23, 2026, several of the kit's server and download domains no longer resolved, though one domain for version uploads still pointed to 121.37.194[.]194. The operation appears financially motivated, focusing on mobile wallets and one-time passcodes, though Doctor Web previously described Baohuo as "a tool for boosting the number of subscribers in Telegram channels."
Related
