A commercial Android spyware kit called uCreator can hijack Telegram and WeChat accounts by embedding malicious code into legitimate apps, according to security researcher Ovi.
The toolkit is designed to steal account credentials, access private data, and take control of accounts. It is distributed through modified Android apps shared outside official app stores and through a custom container app that allows users to run WeChat inside a separate environment.
The Telegram component of uCreator appears to be linked to Baohuo, an Android backdoor documented by Doctor Web in October 2025. At the time, researchers estimated that more than 58,000 devices had been infected with the malware, which was found in modified versions of Telegram X. A comparison of the two investigations by The Hacker News identified matching code namespaces, command names, and command-and-control infrastructure, suggesting that both reports describe the same malware operation. However, it remains unclear whether the developers behind uCreator or one of their customers conducted the earlier campaign.
Ovi published his findings on October 21, 2026, and found that the spyware reaches victims primarily through sideloaded applications and social engineering. Some infected Telegram X versions use the same package name as the legitimate app, making them harder to identify through their names alone. Another infection method involves an application called 洋葱盒子, or Onion Box, which runs other apps inside its own container.
Doctor Web previously traced Baohuo infections to fake app store websites promoted through in-app advertisements. The sites advertised modified Telegram X apps as dating and video chat services and targeted users with banners in Portuguese and Indonesian. Despite this regional focus, Doctor Web’s 2025 analysis found that India accounted for 22.8% of identified infections, followed by Brazil at 20.5% and Indonesia at 9.6%. Modified versions of the app were also discovered on third-party Android marketplaces, including APKPure, ApkSum, and AndroidP.
Ovi obtained access to one of uCreator’s command servers and found victim data apparently associated with users in China and the United States. However, the available information was insufficient to establish the overall number of victims. His investigation documents the toolkit’s technical capabilities rather than confirming how extensively its features have been used in real-world attacks.
The spyware appears designed to target messaging platforms and mobile wallet services, potentially including WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber, GCash, and MoMo. Ovi identified code supporting approximately 20 applications, although his published technical analysis focuses on Telegram and WeChat.
The toolkit’s hooking engine allows malicious code to intercept functions inside targeted applications. When tested on a Google Pixel 10 Pro running Android 17, the engine failed to locate an internal Android function on which it depends, apparently because of changes in newer versions of the operating system. However, Ovi noted that Frida, another instrumentation tool, could still hook applications on the same device. The finding therefore represents a potential obstacle for the spyware’s developers rather than evidence that Android 17 completely prevents the attack.
The latest sample examined by Ovi was dated July 29, 2026, and still contained the older hooking engine. He also recovered samples built for Android 16 but did not report testing them. Devices from Chinese manufacturers were not included in his testing.
Inside a modified Telegram application, uCreator runs alongside the legitimate app code and inherits its identity and permissions. The spyware also operates a local command server within the application, while some of its malicious modules are downloaded after installation, making the initial installer more difficult to analyze.
Once active, the malware can query the application’s message database and retrieve chat history. It can also intercept Telegram’s two-step verification process, capturing the account password in readable form before the application hashes it to generate a login proof.
With these credentials, the toolkit can potentially terminate existing sessions, change the account’s linked phone number, or delete the account. Other functions are designed to lock legitimate owners out while preserving the attacker’s access. The spyware can also conceal an unauthorized session from the device list displayed inside the compromised application.
Doctor Web documented similar session-hiding capabilities in Baohuo and reported that the malware transmitted account information, including phone numbers, names, and passwords, to its command server every three minutes. Neither investigation established whether a concealed session would remain visible in other legitimate Telegram applications installed on the same device.
Ovi emphasized that the code demonstrates what the toolkit is capable of doing, not that every function has been successfully deployed against victims. Similar techniques have appeared in earlier Android malware, including FjordPhantom in 2023 and the GodFather banking trojan in 2025. However, uCreator stands out because it is offered as a commercial product that customers can operate remotely against applications for which its developers create dedicated modules.
The WeChat component uses a different approach in some cases, running the legitimate application inside uCreator’s own virtualized container. The toolkit can extract the account’s login identity, compress the application’s data, and upload it to a remote server. It also includes a login script intended to clone the account, focusing on account access rather than simply collecting chat history.
Ovi and another researcher, Jurre, also discovered backend source code associated with the toolkit on a self-hosted GitLab server. The exposed code revealed a cloud-based management console rented by merchants and resellers. Commands include customer identifiers, allowing individual customers to control their assigned devices and target selected victims.
The infrastructure supports both controlled devices operated by the attackers and compromised phones belonging to victims. Its functions include capturing login authorizations, adding contacts in bulk, collecting profile information, and backing up entire accounts. A scheduling system sets activity windows, daily limits, and account-specific budgets, apparently helping automate activity in ways intended to resemble normal user behavior and avoid platform risk checks.
The exposed code history indicated that approximately three dozen developers had worked on the system, with activity aligned to China’s time zone. Some development work reportedly continued in October 2026. The recovered backend primarily covered personal WeChat and WeCom accounts; Ovi did not find comparable Telegram management functionality in the exposed code and noted that only one of several GitLab servers had been accessible.
Ovi linked parts of the operation to three companies in China’s Hunan province. The connections involved the toolkit’s brand website, a server certificate, a government website filing associated with a command server, and the digital signature of the Windows control program. He described the possibility of common ownership as plausible but unproven.
The product is known internally as YingGai, and records indicate that the product line dates back to September 2021. The samples analyzed by Ovi were created between 2024 and July 2026. Given the toolkit’s focus on mobile wallets and one-time passwords, he suspects it may support financially motivated crime. Doctor Web, meanwhile, previously described Baohuo as a tool used to increase the number of subscribers in Telegram channels.
Researchers identified two potential traces that may help detect uCreator infections: a file named TgJarPine.dex found in the assets of some modified Telegram applications, and an original APK stored under cache/lspatch/origin/*.apk. The second indicator is associated with LSPatch, a third-party Android application patching tool, and can also appear in applications modified for legitimate purposes.
A DNS check conducted by The Hacker News on October 23, 2026, found that several domains associated with the toolkit’s command servers and downloads no longer resolved. However, the version-upload domain hw.android.videoflow[.]cn still pointed to the IP address 121.37.194[.]194 at the time of the check.
The investigation also identified several file hashes, domains, and IP addresses associated with the toolkit, including samples linked to modified Telegram and Telegram X applications, the WeChat container, the Onion Box application, and its Windows control program. These indicators can help security teams investigate suspected infections, although individual indicators should be assessed alongside other evidence because infrastructure and files may change over time.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Users can reduce their risk by installing Android applications only from trusted official sources, avoiding app installation links shared through unsolicited messages or advertisements, and checking an application’s developer and digital signature when possible. Anyone who suspects that they installed a modified messaging app should stop using it for sensitive activity and review their accounts from a separate, trusted device. They should also revoke unfamiliar sessions, change affected passwords and recovery details, and contact the relevant platform’s official support channel if account access has been lost.
