uCreator Android Spyware Kit Targets Telegram and WeChat, Stealing 2FA and Cloning Accounts
A rentable Android spyware kit named uCreator is capable of stealing Telegram 2FA passwords and cloning WeChat accounts by embedding malicious code into modified versions of these popular applications.
A sophisticated and commercially available Android spyware kit, dubbed uCreator, has been identified as a significant threat, capable of hijacking Telegram and WeChat accounts. Researchers discovered that uCreator operates by embedding its malicious payload within modified versions of these legitimate applications. These tampered apps are then distributed outside of official app stores or delivered via a proprietary container application, tricking users into installing them.
The Telegram-specific component of the uCreator kit has been linked to the Baohuo backdoor, which was previously detailed by security firm Doctor Web in October 2025. Doctor Web's analysis at the time indicated that Baohuo had infected over 58,000 devices, primarily through modified Telegram X applications. A comparative analysis by The Hacker News revealed matching code namespaces, command-and-control (C2) server infrastructure, and command names between the Baohuo backdoor and the uCreator kit, strongly suggesting a connection.
While Ovi's analysis, published in October 2026, does not explicitly reference Doctor Web's findings, and Doctor Web did not name the kit, the technical similarities are compelling. It remains unclear whether the campaign tracked by Doctor Web was conducted by the kit's creators or by one of their customers, highlighting the distributed nature of such malware-as-a-service offerings.
Victims are primarily exposed through sideloading, a process where users install application files directly from sources other than official app stores, often facilitated by social engineering tactics. The second infection vector involves the kit's creators' own container app, named "洋葱盒子" (Onion Box), which allows other applications to run within its isolated environment. Some of the tampered Telegram X copies were found to use the same package name as the legitimate app on Google Play, making them difficult to distinguish based on name alone.
Doctor Web previously reported that Baohuo copies had been circulating since mid-2024, often promoted through in-app advertisements leading to fake app store websites. These sites targeted users in Brazil and Indonesia, offering Telegram X as a dating or video chat application. Despite the localized advertising, infections were most prevalent in India, followed by Brazil and Indonesia, according to Doctor Web's 2025 data.
The uCreator kit's hooking engine, responsible for intercepting application functions, was tested on a newer Android version (Android 17) and encountered issues due to changes in internal Android functions. However, researchers noted that alternative tools like Frida could still achieve similar hooking capabilities, suggesting that while the kit may require updates for the latest Android versions, it is not inherently blocked. The most recent sample analyzed, dated July 2026, still utilized the older engine.
For Telegram accounts, the spyware operates by running with the app's credentials and permissions, gaining access to message stores and sensitive data. It specifically targets the two-step verification (2FA) password, intercepting it in a readable form before it is hashed. This allows attackers to reset account sessions, change linked phone numbers, or delete accounts, while also enabling them to hide their own active sessions from the user's device list. The kit can also exfiltrate chat history and account details.
Regarding WeChat, uCreator employs app virtualization to run the legitimate app within its container. It can then extract the account's login identity, zip the app's data, and upload it, using a bundled script to clone the account. Researchers also discovered the kit's back-end code on a self-hosted GitLab server, revealing a cloud console rented by merchants and resellers. This console allows each customer to direct their own fleet of infected phones against specific targets, indicating a highly organized and segmented operation.
While the kit's capabilities are extensive, researchers emphasize that the observed functionalities do not necessarily mean all features are actively exploited by every customer. The kit's modular design and commercial availability make it a versatile tool for various threat actors interested in compromising popular messaging and financial applications, particularly in regions like China and Southeast Asia.