A new Android spyware kit, named **uCreator**, is being rented out to threat actors, enabling them to hijack **Telegram** and **WeChat** accounts. Cybersecurity researcher **Ovi** discovered that the kit achieves this by embedding its malicious code within functional copies of these messaging applications, which are then distributed outside official app stores. Another vector involves running **WeChat** within the kit makers' dedicated container app, "Onion Box" (洋葱盒子).  ### Connection to Baohuo Backdoor The **uCreator** kit's **Telegram** component bears a striking resemblance to **Baohuo**, a backdoor previously reported by **Doctor Web** in October 2025. **Doctor Web** had identified **Baohuo** within tampered versions of **Telegram X**, an Android app from **Telegram**, estimating over 58,000 infected devices at the time. Comparison of **Doctor Web**'s technical description of **Baohuo** with **Ovi**'s analysis reveals identical code namespaces (`com.ucreator.tgjar`), command-and-control (C2) servers, and command names. While **Ovi**'s report, published October 21, 2026, did not reference **Doctor Web**'s findings, the similarities strongly suggest a shared origin or methodology. ### Attack Vectors and Victim Profile Victims are primarily compromised through sideloading tampered apps, often facilitated by social engineering tactics. **Doctor Web**'s earlier research indicated that **Baohuo** spread through in-app advertisements leading to fake app store sites, which promoted **Telegram X** as a dating and video chat app. These campaigns, initially targeting Portuguese and Indonesian speakers, ultimately saw infections spread globally, with India, Brazil, and Indonesia being top affected countries. Compromised apps were also found on third-party stores like **APKPure**, **ApkSum**, and **AndroidP**, with some even masquerading under official developer names, albeit with different digital signatures. **Ovi** gained access to one of the kit's command servers, revealing victim data primarily from China and the United States. While **Ovi**'s report focuses on technical capabilities, potential targets appear to be users of mobile wallets and messaging apps across China and Southeast Asia, including **WeCom**, **QQ**, **WhatsApp**, **LINE**, **Zalo**, **KakaoTalk**, **Viber**, **GCash**, and **MoMo**. The kit's hooking engine, while encountering issues on newer Android versions like Android 17, is not deemed to be entirely blocked, suggesting ongoing development to bypass such defenses. ### How Account Takeovers Occur Within a tampered **Telegram** app, the **uCreator** code initializes with the app, inheriting its identity and permissions. This grants it the same level of access as the legitimate, signed-in application. A local command server runs within each tampered app, downloading target-specific code post-installation to evade initial analysis. Attackers can query the app's message store to retrieve chat history. Crucially, the kit hooks into **Telegram**'s two-step verification (2FA) process, intercepting the password in plaintext before it's hashed. With this password, attackers can reset sessions, change linked phone numbers, or delete accounts. The code also includes mechanisms to hide the attacker's session from the user's device list, further entrenching their presence.  For **WeChat**, the kit uses app virtualization, running the legitimate app within its own container. It then extracts the account's login identity, compresses and uploads app data, and uses a bundled login script to clone the account. This method targets the account itself rather than just chat history. ### Leaked Back End and Operational Insights **Ovi** and fellow researcher **Jurre** uncovered the kit's back-end code on a self-hosted **GitLab** server, which was not restricted by IP addresses. This leak revealed a cloud console used by merchants and resellers to rent the kit. Each command issued includes a customer ID, indicating that customers independently direct their attacks against chosen victims. Commands are dispatched to both controlled "phone farm" devices and victims' phones. The kit can capture login authorizations, bulk add friends, collect contact and profile data, and back up entire accounts. A sophisticated scheduler manages activity timing, daily limits, and per-account budgets, making the malicious actions appear more human and less likely to trigger platform risk checks—a process the code refers to as "account cultivation." Analysis of the code's history shows approximately three dozen developers, primarily working on China time, with active contributions as recently as October 2026. The leaked back end specifically covers personal **WeChat** and **WeCom** accounts, though **Ovi** notes that this was only one of several **GitLab** servers. ### Attributing the Threat Actors **Ovi** has linked components of the operation to three companies in Hunan province, China. These links include a connection to the kit's brand website, a server certificate, a government website filing for a command server, and the digital signature on the kit's Windows control program. While a shared owner is plausible, it remains unproven. The kit's internal name is **YingGai**, with records dating back to September 2021. Samples studied by **Ovi** span from 2024 to July 2026. Given its focus on mobile wallets and one-time passcodes, financial motivation is suspected. This contrasts with **Doctor Web**'s earlier assessment of **Baohuo** as a tool for boosting **Telegram** channel subscribers. ### Indicators of Compromise (IoCs) Two reliable indicators of compromise left by the **uCreator** kit on a phone are: 1. A code file, `TgJarPine.dex`, found within the assets of some tampered **Telegram** copies. 2. The original app copy left by **LSPatch**, a common patching tool, at `cache/lspatch/origin/*.apk`. It's important to note that this second trace can also appear in apps legitimately patched with **LSPatch** for other reasons.