Android Spyware Kit uCreator Hijacks Telegram 2FA, Clones WeChat Accounts

A rentable Android spyware kit called uCreator hides malicious code inside working Telegram and WeChat apps to steal two-factor passwords and clone accounts. Researcher Ovi linked the kit to the Baohuo backdoor and found its back-end code on an exposed GitLab server, revealing a cloud-based operation run by customers across China and Southeast Asia.

A rentable Android spyware kit called uCreator hides attacker code inside functioning copies of Telegram and WeChat, letting customers steal two-factor authentication passwords and clone messaging accounts. Researcher Ovi published technical analysis on October 21, 2026, linking the kit to Baohuo, a backdoor Doctor Web documented in October 2025.

The kit, which its makers call YingGai, spreads through sideloaded app files and a container app named Onion Box (洋葱盒子) that runs other apps inside itself. Some tampered Telegram X copies use the real app's package name, making them hard to spot by name alone. Doctor Web found Baohuo copies spreading since mid-2024 through in-app ads that led to fake app stores in Portuguese and Indonesian; infection maps from 2025 showed India at 22.8%, Brazil at 20.5%, and Indonesia at 9.6%. The copies also appeared on APKPure, ApkSum, and AndroidP, with one APKPure listing carrying the official developer's name but a different digital signature.

Inside a tampered Telegram app, the malicious code runs with the app's own identity and permissions. Each copy also runs a local command server. Attackers download the target module after installation, which keeps the installer file small and harder to analyze. Attackers use the code to hook the 2FA password entry step, copying the readable password before the app hashes it. With that password, attackers can reset logged-in sessions, change the linked phone number, or delete the account. Attackers also use code to lock out the owner while keeping the attacker's session alive, and hide that session from the device list shown in the app. The attackers send the account's phone number, name, and password to its server every three minutes. Neither Ovi nor Doctor Web confirms whether a hidden session remains visible on the user's other, untampered Telegram apps.

For WeChat, attackers run the unchanged app inside the kit's container. A command copies out the account's login identity, then zips the app's data and uploads it. A bundled login script clones the account. Chat history stays untouched.

The leaked back-end files describe a cloud console that merchants and resellers rent. The system tags every command with the customer's ID, directing a shared phone fleet at victims each customer selects. Commands go to both the kit's phone farm and victim devices, where the software captures login authorizations, adds friends in bulk, collects and profile data, and backs up full accounts. The operators use a scheduler to set random daily limits and per-account budgets to make the activity look human. The developers label this process "account cultivation," Ovi said. three dozen developers, working on China time, appear in the commit history, with some still making changes in October 2026.

The apparent targets include users of mobile wallets and messaging apps across China and Southeast Asia, including WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber, GCash and MoMo. Ovi found code supporting roughly 20 apps but published details only for Telegram and WeChat. The hooking engine depends on an internal Android function that changed in Android 17; on a Pixel 10 Pro running Android 17, the engine failed to locate that function. Researchers could still hook apps with Frida on that phone, so Ovi said the issue is extra work for the kit's makers, not proof that Android 17 blocks the attack. The newest sample, dated July 29, 2026, still carried the old engine.

Ovi ties parts of the operation to three companies in Hunan province, China. One company links to the kit's brand website and a server certificate, another to a government filing for a command server, and a third to the Windows control program's digital signature. Ovi said a shared owner is plausible but unproven. The product line appears in records dating to September 2021, with samples spanning 2024 to July 2026.

Investigators can find two reliable traces on a phone: a file named TgJarPine.dex in the assets of some tampered Telegram copies, and an original app copy at cache/lspatch/origin/*.apk left by the LSPatch patching tool. Because LSPatch itself creates the second trace, it can appear in apps patched for other reasons. The kit's infrastructure includes command servers at hpncallback.gold5play[.]com and hpncallback.qianxunlbs[.]com, download hosts such as telegram-apk.uzyzx[.]com, and Redis servers at 159.138.237[.]10:32115 and 159.138.229[.]12:26379. By October 23, 2026, several of these domains no longer resolved, though the version-upload server at hw.android.videoflow[.]cn still pointed to 121.37.194[.]194.

Users should avoid sideloading Telegram X or WeChat copies from outside official stores, verify digital signatures, and check devices for TgJarPine.dex or unexpected files in cache/lspatch/origin/*.apk. Anyone who installed a tampered Telegram copy should change their 2FA password from a clean device, review active sessions, and check linked phone numbers. The kit's focus on wallets and one-time passcodes suggests attackers aim for financial gain.

Source : thehackernews.com