Rentable uCreator Spyware Hides Inside Fake Telegram and WeChat Apps to Hijack Accounts

A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, according to researcher Ovi. It only reaches people who install a tampered copy from outside the official app stores, or who run WeChat inside the kit makers' own container app, called Onion Box. Ovi found the tampered apps spread through sideloading (installing an app file directly instead of from an app store) and through social engineering, though he could not confirm how every victim was infected.

The Hacker News compared Ovi's report with Doctor Web's October 2025 findings on a backdoor called Baohuo, found in tampered copies of Telegram X. The code namespace, command server and command names match. Doctor Web estimated more than 58,000 infected devices at the time. It is not clear whether the kit's makers or one of their customers ran that campaign. Some tampered copies use the same package name as the real app on Google Play, so the name alone does not give them away. Doctor Web found copies spreading since mid-2024 through in-app ads leading to fake app store sites, and in third-party stores including APKPure, ApkSum and AndroidP.

Ovi accessed one command server, which held data on victims apparently in China and the United States, but not enough for a reliable count. He describes his report as an analysis of technical capability, not a measurement of victim impact.