uCreator Android Spyware Targets Messaging Apps, Steals 2FA Codes

• •uCreator spyware targets messaging apps like Telegram and WeChat.
• •It can intercept 2FA codes and clone accounts through tampered app versions.
• •The spyware's architecture allows for extensive data extraction from multiple applications.

The uCreator Android spyware, also known as YingGai, is a commercial surveillance platform that targets messaging applications including Telegram and WeChat. It operates by hiding its malicious code within tampered versions of these apps, which are distributed outside official app stores. The spyware can intercept two-factor authentication (2FA) codes and clone accounts. Research indicates that over 58,000 devices were previously infected by a related backdoor named Baohuo, which was reported in October 2025. The current campaign appears to focus on users in China and Southeast Asia, with capabilities to extract sensitive data from various messaging and wallet applications. The spyware's architecture includes a VirtualApp engine and a cloud-phone farm for live control. Although the exact number of affected users is unclear, the potential impact is significant due to the breadth of targeted applications. The spyware's exploitation status remains uncertain, with no confirmed reported yet.