uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps

Reddit •/u/0x0v1 • October 21, 2026

uCreater (the vendor's own name for the product is YingGai ) is a commercial Android surveillance platform built around 群控 (“mass control”). Branded through packages in the com.ucreator.* namespace, it is not a single malware family but a productized framework: a VirtualApp/LSPatch engine, a library of per-application hook modules, a Redis and HTTP control plane, a cloud-phone farm for live screen control, and a Windows operator console. Customers can rent the platform and deploy its capabilities against different applications on a target device. Despite this breadth and multi year usage, I found little public threat reporting documenting the platform's architecture. submitted by /u/0x0v1 [link] [ ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

uCreator Android Spyware Targets Messaging Apps, Steals 2FA Codes The uCreator Android spyware, also known as YingGai, is a commercial surveillance platform that targets messaging applications including Telegram and WeChat. It operates by hiding its malicious code within tampered versions of these apps, which are distributed outside official app stores. The spyware can intercept two-factor authentication (2FA) codes and clone accounts. Research indicates that over 58,000 devices were previously infected by a related backdoor named Baohuo, which was reported in October 2025. The current campaign appears to focus on users in China and Southeast Asia, with capabilities to extract sensitive data from various messaging and wallet applications. The spyware's architecture includes a VirtualApp engine and a cloud-phone farm for live control. Although the exact number of affected users is unclear, the potential impact is significant due to the breadth of targeted applications. The spyware's exploitation status remains uncertain, with no confirmed reported yet. 2 sources 51

Extracted Entities

uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps

The full story

Extracted Entities

Attack Types (1)

Platforms (3)

Tools (3)