A rentable Android spyware kit called uCreator can take over Telegram and WeChat accounts through modified apps or an attacker-controlled app container, according to researcher Ovi. His analysis, published October 21, 2026, describes capabilities to capture login credentials, retrieve Telegram messages and clone WeChat accounts, but does not establish how many people have been affected.
The documented routes require users to install a tampered app distributed outside official stores or run WeChat inside the kit makers’ container, 洋葱盒子 ("Onion Box"). Ovi found evidence of sideloading—installing app files directly—and social engineering, although he could not establish how every victim became infected.
Some modified Telegram X copies retain the legitimate app’s package name, making that identifier insufficient to distinguish them. The spyware runs inside the messaging app with its identity and permissions, giving it access available to the signed-in application.
Telegram credentials and account controls
Ovi found that the kit downloads code for individual target apps after installation, making the installer alone less revealing. Each tampered app also hosts a local command server. In Telegram, attackers can issue arbitrary database queries against the message store to retrieve chat history.
The kit intercepts Telegram’s two-step verification password before the app hashes it to generate a login proof. That exposes the readable password despite the account’s additional authentication protection.
The code supports resetting logged-in sessions, changing the linked phone number and deleting the account. Other functions are designed to exclude the owner while preserving attacker access, including hiding the attacker’s session from the device list displayed by the modified app. The findings do not establish whether that session would remain visible in another, untampered Telegram app.
Ovi cautioned that the code demonstrates technical capability, rather than evidence that attackers have executed every stage of an account takeover.
The Hacker News compared his analysis with Doctor Web’s October 2025 report on Baohuo, a backdoor found in modified Telegram X apps. It identified the same com.ucreator.tgjar namespace, command-and-control server and matching command names. Doctor Web also described session hiding and said Baohuo sent account phone numbers, names and passwords to its server every three minutes.
Doctor Web estimated more than 58,000 infected devices at the time of its report. That historical estimate is not a current uCreator victim count. Whether the kit’s developers or a customer operated the campaign Doctor Web tracked remains unclear.
WeChat cloning and a rented control platform
For WeChat, uCreator can run the unchanged app inside its own container. Ovi found a command that extracts the account’s login identity, followed by functions that compress and upload app data and use a bundled login script to clone the account. This component targets account access rather than chat history.
Ovi and researcher Jurre also discovered back-end code on a self-hosted GitLab server that, unlike other parts of the infrastructure, was not restricted to approved IP addresses.
The code describes a cloud console rented to merchants and resellers. Commands include a customer identifier, allowing customers to direct their allocated devices at selected victims. The system controls both victims’ phones and an operator-controlled phone farm, with functions for capturing login authorizations, adding friends in bulk, collecting contact and profile information, and backing up accounts.
A scheduler assigns operating windows, randomized daily limits and per-account budgets intended to make activity resemble human use and evade platform risk checks. The exposed back end covered personal WeChat and WeCom accounts; Ovi said it did not appear to cover Telegram. Only one of several GitLab servers was exposed.
Reach and compatibility remain uncertain
Ovi accessed a command server containing data apparently associated with victims in China and the United States, but insufficient information for a reliable count. He found support code for about 20 apps, including messaging and mobile wallet services, while publishing code only for Telegram and WeChat. The apparent targeting of users in China and Southeast Asia remains unconfirmed.
A compatibility test also limits what can be concluded about current devices. On a Pixel 10 Pro running Android 17, the kit’s hooking engine—which intercepts app functions—failed to locate an internal Android function it needed. Frida could still perform comparable hooking on that phone, so Ovi characterized the result as additional development work for the operators, not evidence that Android 17 prevents the attack.
The newest sample he examined, dated July 29, 2026, retained the old engine. He recovered samples built for Android 16 but did not report testing that version, and had not tested phones from Chinese manufacturers.
Ovi linked parts of the operation to three companies in Hunan province, China, through website, certificate, filing and software-signature records. He described shared ownership as plausible but unproven. The makers call the product YingGai, with records of the product line dating to September 2021.
On devices, Ovi identified TgJarPine.dex in the assets of some modified Telegram apps and an original app copy at cache/lspatch/origin/*.apk as useful traces. The latter is created by the legitimate LSPatch patching tool and can also occur in apps modified for other purposes, so its presence alone does not establish a uCreator infection.
