Researchers expose Android spyware targeting Telegram and WeChat

Security researcher 0x0v1, known as Ovi, has exposed a commercial Android surveillance platform branded as YingGai uCreator, which hooks into popular messaging and wallet apps without requiring root access. The researchers describe a multi-tenant system that runs modified builds of Telegram, WeChat and GCash to harvest messages, cleartext two-factor passwords and session tokens.

The platform is deployed via sideloaded repackaged apps or through a container app named Onion Box, with target-specific hook modules downloaded after installation from Alibaba Cloud OSS and MinIO storage. Evidence tying parts of the operation to Changsha-based entities includes domain registrations for Hunan Youchuang Technology, an ICP filing for Changsha Sukai Network, and a DigiCert code-signing certificate for Changsha Zhuoqing E-commerce. An exposed GitLab server also shows about three dozen developers and activity linked to the China Standard Time cohort.

Functionally, the spyware operates by in-process hooking inside non-root VirtualApp/LSPatch/Pine-based containers to modify app behaviour in memory. In Telegram, it can execute raw SQL against live MessageStorage, intercept two-step verification codes and passwords in cleartext, and hide devices from active sessions; in WeChat, the kit can extract login tokens, zip data and upload contacts to Alibaba Cloud.

Jurre, a second researcher, helped reveal the backend workflow, including a multi-tenant console that uses Kafka, RocketMQ and Nacos schedules to pace operations and evade fraud checks. The broader attribution is mixed: while the cited artefacts tie specific infrastructure to Changsha companies, the operators are viewed as financially motivated crimeware rather than state-led tools. Jurre’s review confirms co-tenancy in cloud ingress but notes no evidence of common ownership across the ecosystem.