uCreator Android Kit Targets Telegram 2FA and WeChat Accounts
Researchers have detailed uCreator, a rentable Android spyware kit capable of intercepting Telegram two-step verification passwords and cloning WeChat accounts. Researcher Ovi found that the kit hides code in working copies of Telegram and WeChat, while Doctor Web’s earlier analysis of the Baohuo backdoor estimated more than 58,000 infected devices in a 2025 campaign.
The Telegram component identified by Ovi matches Baohuo on the com.ucreator.tgjar namespace, command-and-control server and command names. It remains unclear whether the uCreator operators or a customer of the kit conducted the campaign examined by Doctor Web.
Distribution depends on tampered apps and containers
The spyware reaches victims who sideload modified applications rather than downloading them from official stores, often after social engineering. Ovi also described an attacker-controlled container app named 洋葱盒子, or Onion Box, which can run other apps inside itself. Some altered Telegram X packages use the legitimate Google Play package name, making the name alone an unreliable signal.
Doctor Web said Baohuo had been distributed since mid-2024 through in-app advertisements leading to fake app-store pages. Those pages promoted Telegram X as a dating and video-chat service. Its 2025 telemetry placed India first among observed infections at 22.8%, followed by Brazil at 20.5% and Indonesia at 9.6%.
Telegram hooks expose credentials before hashing
In a tampered Telegram build, uCreator starts alongside the app and inherits the signed-in app’s identity and permissions. Target modules are downloaded after installation, limiting what can be learned from the installer alone. The kit can submit database queries to the message store and retrieve chat history.
More critically, Telegram’s two-step verification password is entered into the application before it is turned into a login proof. Ovi found that the kit hooks this step and copies the password in readable form before hashing. The documented code can then reset sessions, change the linked phone number or delete the account, while mechanisms are designed to lock out the legitimate owner and conceal an attacker session in the altered app’s device list.
Ovi stressed that the technical analysis demonstrates capability rather than proving every account-takeover step has been used in live operations. His testing on a Pixel 10 Pro running Android 17 found the kit’s existing hooking engine could not locate an internal function altered in newer Android versions, although Frida could still hook apps on the same device.
WeChat module supports account cloning
For WeChat, uCreator can run the unchanged app in its own virtualized container. A command extracts the login identity, archives app data and uploads it, after which a bundled login script is intended to clone the account. Ovi said this component is aimed at the account itself rather than its chat history.
Ovi and researcher Jurre also located backend code on a self-hosted GitLab server. The code describes a cloud console rented by merchants and resellers, with each command carrying a customer ID. It includes scheduling controls, random daily limits and per-account budgets intended to make activity resemble human use and bypass platform risk checks.
Detection and business implications
Ovi identified two potentially useful phone-level traces: a TgJarPine.dex file in the assets of some modified Telegram copies, and original APK files at cache/lspatch/origin/*.apk. The latter is not conclusive on its own because LSPatch can leave the artifact in applications modified for other reasons.
For businesses, the immediate control is to limit sideloading on managed Android devices, validate application provenance and investigate suspected altered messaging clients. Teams should treat mobile messaging credentials as high-value access material, because a compromised in-app login flow can undermine protections that appear secure from the user interface alone.