uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts

Oct 26, 2026 · Original article ↗

Summary

Researchers found the rentable uCreator Android kit can steal Telegram 2FA passwords and clone WeChat accounts through tampered apps or a container. Its code exposes a multi-customer backend; victim impact and some operator links remain unconfirmed.

Key points

Ovi found that uCreator can be installed through tampered apps distributed outside official stores or run WeChat inside its Onion Box container; how every victim was infected is unknown.
In tampered Telegram apps, the kit hooks the login process to capture the 2FA password in readable form and can query the app's message store for chat history.
The Telegram code can manipulate sessions, phone numbers or accounts, and hide an attacker's session from the device list shown by the tampered app.
For WeChat, the kit can copy login identity, package and upload app data, and use a login script to clone an account. Ovi says this targets the account, not its chat history.
Ovi found a rented backend with customer-specific commands and scheduling designed to manage activity across controlled and victim phones. The code shows capabilities, not that every step was used against victims.
Ovi found code similarities between uCreator's Telegram component and Baohuo, including a namespace, C2 server and command names; whether the kit makers or a customer ran Doctor Web's earlier campaign is unclear.
On a Pixel 10 Pro running Android 17, uCreator's hooking engine could not find an Android function it relies on, but Frida could still hook apps; this does not establish that Android 17 blocks the attack.

Article Details

Attack Vectors: Tampered Telegram and Telegram X copies are distributed outside official app stores through sideloading, fake app-store sites, and in-app ads; Ovi also identified social engineering, though he could not confirm the infection route for every victim.
A container app called 洋葱盒子 (Onion Box) can run WeChat inside a virtualized environment.
After installation, tampered apps download code for their target app and run it under that app's identity and permissions.
The kit hooks Telegram's two-step verification flow to capture the password before it is hashed, and can manipulate account sessions and settings.
For WeChat, the kit can copy login identity data, zip and upload app data, and use a bundled script to clone the account.
Defensive Notes: Ovi identified TgJarPine.dex in the assets of some tampered Telegram copies as a phone-side trace.
Ovi also identified cache/lspatch/origin/*.apk as a trace left by LSPatch, but noted it may also appear in apps patched for other reasons.
Ovi said the kit's hooking engine could not find a relied-on internal Android function on a Pixel 10 Pro running Android 17; he described this as extra work for the kit's makers, not proof that Android 17 blocks the attack.

Indicators of compromise

Type	Indicator	Context
IPV4	`121[.]37[.]194[.]194`	IP address still associated with the kit's version-upload server when The Hacker News checked DNS records on October 23, 2026.