uCreator Android Spyware Steals Telegram 2FA and Clones WeChat Accounts

uCreator Spyware Functionality

The uCreator Android spyware kit allows attackers to take control of Telegram and WeChat accounts. It operates by embedding its malicious code within functional, but tampered, copies of these popular messaging applications. This enables the spyware to steal Telegram two-factor authentication (2FA) passwords and clone WeChat accounts, giving attackers unauthorized access to user communications and data.

Distribution Methods

The primary methods of distribution for uCreator involve sideloading, where users install application files directly rather than through official app stores. Additionally, the kit makers offer their own container application, named "Onion Box" (洋葱盒子), which runs other applications inside itself, potentially including the compromised versions of Telegram and WeChat. Social engineering tactics are also used to trick users into installing these malicious apps.

Connection to Baohuo Backdoor

Analysis by researcher Ovi indicates that the Telegram component of uCreator matches Baohuo, a backdoor previously reported by Doctor Web in October 2025. Doctor Web found Baohuo in tampered copies of Telegram X, an Android app. Technical details, including the code namespace (com.ucreator.tgjar), command-and-control (C2) server, and command names, are consistent between Ovi's analysis and Doctor Web's findings. Doctor Web estimated over 58,000 devices were infected by Baohuo at the time of their report.

Targeted Regions and Apps

Doctor Web's 2025 report indicated that Baohuo copies had been circulating since mid-2024, often promoted through in-app ads leading to fake app store sites. These sites advertised Telegram X as a dating and video chat app, with banners available in Portuguese and Indonesian. While India had the highest infection rate at 22.8%, Brazil and Indonesia also showed significant numbers. Ovi's access to a command server revealed victim data potentially from China and the United States, suggesting a broader reach. The apparent targets are users of mobile wallets and messaging apps, particularly in China.