uCreator Android spyware steals Telegram and WeChat accounts

A new Android spyware product named uCreator has been found covertly taking over Telegram and WeChat accounts by embedding its malicious code inside working copies of these apps. The tainted Telegram copies use a backdoor known as Baohuo, first described by Doctor Web in October 2025, which can capture a Telegram 2FA password and use it to generate a login proof on the device.

This allows attackers to reset sessions, change the linked phone number, or delete the account, while other parts of the code can hide the attacker’s session from the device’s app list. The kit’s WeChat operation uses app virtualization to extract a login identity and then clone the account, with data being uploaded to a back-end server. The campaign relies on sideloading and social engineering, and in some cases the tainted Telegram X copies share the real app’s package name, making detection harder.

Ovi, the researcher who studied uCreator, linked parts of the operation to a “YingGai” product line dating back to 2021, with samples from 2024–July 2026. The attacker’s infrastructure includes a self-hosted back end exposed on GitLab and multiple command servers that push commands to the “phone farm” of infected devices, enabling actions such as harvesting login credentials, contact data, and even bulk-adding friends.

The sample chain includes a local command server inside each tampered app, and a known indicator of compromise is the TgJarPine[.]dex file within tampered Telegram copies, along with an LSPatch-origin APK present in cache/lspatch/origin/*.apk. The researchers note that while some infections led to significant exposure, exact victim counts remain uncertain, and it is not confirmed that all steps from infection to credential exfiltration have been observed in the wild.

The investigation attributes parts of the operation to three Hunan-based companies, with some ties to a government-linked server and to the kit’s Windows control program signature. Doctor Web has published separate indicators for Baohuo.