Spyware uCreator Compromises Telegram's Two-Factor Authentication

• •uCreator spyware steals Telegram 2FA passwords via modified APKs.
• •The malware can also clone WeChat accounts and intercept sensitive information.
• •Brazil and India are primary targets, highlighting risks of unofficial app installations.

The uCreator spyware targets Android devices, stealing Telegram's two-factor authentication (2FA) passwords. It is distributed through modified APKs of legitimate messaging apps, allowing attackers to gain control over user accounts. The malware can intercept 2FA codes as they are entered, compromising the security of accounts. The spyware is also capable of cloning WeChat accounts using a virtualized environment. Brazil and India are among the primary targets of this campaign, with significant risks associated with installing unofficial app versions. Security researchers have linked uCreator to the previously known Baohuo malware, which has affected thousands of devices. Users are advised to avoid installing altered messaging applications and to maintain security measures.