uCreator (uCreater) rentable Android spyware kit trojanizes Telegram, WeChat and GCash to steal 2FA passwords and clone accounts; linked to Baohuo

Linha do tempo

1. securityaffairs.com ↗ · pub. 26/10/2026 09:11 · coletado 26/10 11:00

   uCreater rentable Android spyware repackages Telegram, WeChat and GCash to steal OTPs, sessions and wallet data

   ler a análise desta fonte ocultar

   Researcher Ovi documented uCreater, a rentable, multi-tenant Android spyware platform that hides inside repackaged legitimate apps such as Telegram, Telegram-X, WeChat and GCash. Its YingGai framework intercepts one-time passwords, steals account and chat data, collects contacts, manipulates sessions and spoofs camera feeds to bypass identity checks. Victims install modified apps through sideloading or social engineering, though the initial delivery vector could not be confirmed for every victim. Samples date from 2024 to 2026, and five samples reached the control server, confirming active deployments. The number of victims and customers is unknown. Ovi assesses the platform as financially motivated crimeware sold by a vendor in Changsha, Hunan, but attribution to a specific legal entity is unproven.

   Technical Details

   • Virtualization and hooking: uCreater uses VirtualApp containers, LSPatch (no root required) and Pine runtime hooks, plus XposedBridge hooks and reflection. It operates inside the real app with no fake overlay, unlike GodFather, and Ovi found no link between the two.
   • Delivery and staging: The repackaged APK is thin. Target-specific code is fetched after installation from Alibaba OSS and MinIO buckets and paths named Huuk_<target> and fengzhuang-app. A distribution host is telegram-apk.uzyzx.com. Telegram modules load from TgJarPine.dex or LSPatch, and WeChat runs in a VirtualApp host (va_vx or Onion Box).
   • Local command server: Each hooked app embeds a server with about 40 numbered handlers covering device monitoring, contact and SMS collection, app enumeration, message sending, chat-history retrieval and session management.
   • Telegram module: The Db_MessagesStorageRawQuery handler runs operator-supplied SQL against the live app database. It hooks SRPHelper.getX to capture the two-step verification password in cleartext. It can list or reset sessions, change the linked phone number, delete accounts and hide its own session.
   • WeChat module: It focuses on account access. The _2_0_UploadAppLoginInfo command retrieves login identity information, and app data is uploaded to OSS for account cloning. No evidence was found of access to WeChat's encrypted database.
   • C2: The implant fetches its control address from Redis (Domain key) with a hardcoded fallback. It sends signed JSON beacons to /api/callback/Tg* and receives updates via OSS/MinIO and contacts.vcf.
   • Backend: An exposed GitLab server, found by Ovi and researcher Jurre, held Spring Cloud services, a Vue admin console, and 13 repositories with about three dozen developers on China-time timestamps. The stack uses Kafka, RocketMQ, Redis and Nacos on Aliyun and Huawei Cloud. Ovi counts about 20 target apps, six operator domains, and roughly 48 hosts matching the Tengine gateway fingerprint.
   • Limits: The bundled Pine engine fails on Android 17 (Pixel 10 Pro), though updating it could restore functionality. The source code demonstrates capabilities, not that every action was performed against victims.
   • Attribution leads (unproven): Hunan Youchuang Technology, Changsha Sukai Network (ICP holder for qianxuncc.cn) and Changsha Zhuoqing E-commerce. A commit used a Tanzhou email domain. Shared infrastructure with a Hunan police research institute establishes only co-tenancy.

   Remediation

   • Install Telegram, WeChat and wallet apps only from official stores and avoid sideloaded or modified builds.
   • Check devices for cache/lspatch/origin/*.apk and the TgJarPine.dex asset as infection indicators.
   • Block the listed domains, review active sessions in affected accounts, and rotate two-step verification passwords on suspected devices.
2. thehackernews.com ↗ · pub. 26/10/2026 06:54 · coletado 26/10 08:00 primeiro registro

   uCreator Android spyware kit trojanizes Telegram and WeChat to steal 2FA passwords and clone accounts; linked to Baohuo

   ler a análise desta fonte ocultar

   A rentable Android spyware kit, uCreator (maker brand YingGai), takes over Telegram and WeChat accounts by embedding its code in working copies of the apps, according to researcher Ovi. Victims are reached only through tampered copies sideloaded outside official stores, or by running WeChat inside the makers' container app 洋葱盒子 (Onion Box). The Telegram component matches Baohuo, a backdoor Doctor Web reported in October 2025 in tampered Telegram X copies (more than 58,000 devices estimated). The match rests on the namespace com.ucreator.tgjar, the same C2 server and matching command names. It is unclear whether the kit's makers or a customer ran the campaign Doctor Web tracked. Ovi's report is, in his words, an analysis of technical capability, not a measurement of victim impact.

   Technical Details

   • Delivery: sideloading and social engineering; Ovi could not confirm how every victim was infected. Some tampered Telegram X copies reuse the real Google Play package name. Doctor Web saw Baohuo spread since mid-2024 via in-app ads leading to fake app store sites (Portuguese and Indonesian banners) and via APKPure, ApkSum and AndroidP. Its infection map put India first (22.8%), then Brazil (20.5%) and Indonesia (9.6%).
   • Telegram: the injected code runs with the host app's identity and permissions and starts a local command server inside the app. Per-app modules are downloaded after installation. Attackers can run arbitrary queries against the message store, and the kit hooks the 2FA password entry to copy it in cleartext before hashing. With it they can reset sessions, change the linked phone number or delete the account, lock out the owner and hide the attacker's session from the device list shown in the tampered app. Baohuo sends the phone number, name and password to its server every three minutes.
   • WeChat: app virtualization runs the unchanged app in a container; a command copies the login identity, uploads zipped app data and a bundled script clones the account.
   • Back end: Ovi and researcher Jurre found the back-end code on a self-hosted GitLab server. It shows a cloud console rented by merchants and resellers, with every command tagged by customer ID, a phone farm, bulk friend-adding, login authorization capture, contact and profile collection, and full account backups. A scheduler with time windows, random daily limits and per-account budgets mimics human behavior ("account cultivation"). About three dozen developers working on China time appear in the history, with commits as late as October 2026. The leaked code covers personal WeChat and WeCom, not apparently Telegram.
   • Targeting and attribution: code supports about 20 apps (WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber, GCash, MoMo), but only Telegram and WeChat code has been published. Ovi ties parts of the operation to three companies in Hunan, China, and calls a shared owner "plausible, but remains unproven." He assumes financially motivated use; Doctor Web described Baohuo as a tool for boosting Telegram channel subscribers. The product line dates to September 2021, and the samples studied date from 2024 to July 2026.
   • Android 17: the hooking engine failed on a Pixel 10 Pro running Android 17 because a changed internal function was missing, but Frida still hooked apps. Ovi sees this as extra work for the makers, not a block. The newest sample (July 29, 2026) still used the old engine.
   • Detection traces: TgJarPine.dex in assets of some tampered Telegram copies, and cache/lspatch/origin/*.apk left by LSPatch (which can also appear in legitimately patched apps).
   • Infrastructure status: on October 23, 2026, several server and download domains no longer resolved; hw.android.videoflow[.]cn still pointed to 121.37.194[.]194.

   Remediation

   The article gives no account-recovery steps; neither Ovi nor Doctor Web says whether a hidden session shows on a user's other, untampered Telegram clients. Defenders can hunt for the listed hashes, domains and IPs and the two on-device traces, and should avoid sideloaded or third-party-store copies of Telegram, Telegram X and WeChat.