Researchers uncover rentable Android spyware targeting messaging apps

Researchers describe uCreater as a rentable Android spyware platform that hides inside repackaged legitimate apps to harvest credentials, messages and wallet data from users of messaging apps such as WeChat and Telegram, and mobile wallets like GCash. The YingGai framework can intercept one-time passwords, steal account and chat data, collect contacts, manipulate sessions and spoof camera feeds to bypass identity checks.

Victims may install modified versions of Telegram, WeChat or GCash via sideloading or social engineering. The researcher known as Ovi found stolen data on a control server, but the number of victims and links between operators and customers remain unconfirmed.

Ovi reconstructed much of the post‑installation execution chain from recovered code, with samples dating from 2024 to 2026 and a backend infrastructure described as multi-tenant and rented, hosted on Aliyun and Huawei Cloud in China. The platform reportedly runs around 20 target apps with confirmed code support and maintains six operator domains with dozens of subdomains, three Redis buses, two MQTT buses and a cloud‑phone cluster.

It uses app virtualization techniques (VirtualApp, LSPatch, Pine) to operate inside legitimate apps without root access, enabling actions such as account access, session manipulation, contact collection and exfiltration of messages. The Telegram module can query Telegram’s live database and capture verification data, while the WeChat component focuses on account access.

The research notes several infrastructure links and domain artifacts, but cautions that attribution and operational ownership require further verification.