uCreator: the Android spyware that hijacks Telegram and WeChat

There is a category of threat that doesn't need zero-day exploits or impossible vulnerability chains: all it needs is for the user to install the wrong app. That is what happens with uCreator, an Android spyware kit that, according to researcher Ovi, infiltrates tampered copies of Telegram and WeChat to take over the victim's accounts. We are not talking about a generic trojan: the target is the channel through which many small businesses communicate with customers and suppliers today.

How the deception works

The mechanics are simple to describe and hard to detect with the naked eye. The kit's operators take the Telegram or WeChat code, modify it and insert their own malicious payload, then distribute the result as if it were the legitimate application. The user installs what they believe is their usual messaging app and, from that point on, the spyware operates in the background.

The entry vector is twofold. On the one hand, tampered copies circulate outside the official app stores, that is, through direct downloads, shared links or third-party repositories. On the other, there is the route of a container created by the kit's authors, designed to run WeChat inside it. In both cases, the victim has to take the first step: installing something that doesn't come from the right channel.

What the attacker takes

The kit's two stated objectives are especially sensitive. In Telegram, the spyware looks for two-factor (2FA) passwords, that second lock many teams enable precisely to shield the account. In WeChat, the goal is to clone the account, which opens the door to impersonating the victim before their contacts.

It is worth pausing on the nuance of 2FA. Two-step authentication is not a silver bullet: if the device where the code or password is entered is compromised, the attacker can capture that additional factor just as they would capture the password. The lesson is not that 2FA is useless, but that it protects the account, not the device. An infected phone remains a weak point even if the account has two-factor authentication.

The kit's Telegram component also matches Baohuo, a previously documented backdoor. That is, this is not an isolated piece, but a family of tools that is reused and packaged for sale. The kit's own approach, described as profitable, points to a business model: packaged and commercialized spyware, not the craftwork of a single actor.

Why this matters to an SME

In a small company, the phone is often the only real work tool. The salesperson who handles Telegram, the team coordinating orders with Asian suppliers via WeChat, the self-employed person who manages everything from their phone. When messaging becomes a business channel, compromising it stops being a personal privacy problem and becomes an operational and reputational risk: impersonation before customers, leakage of business conversations, access to internal groups.

And there is a factor that makes the scenario worse: installing APKs outside Google Play is often normalized in certain environments, whether because of internal corporate apps, versions that don't reach the official store or simply out of habit. That normalization is exactly the ground this type of kit needs. As we saw with the file in Downloads that tries to deceive an AI agent, the weak link is rarely the technology: it is the habit of installing without verifying.

What we recommend doing

1. Ban by policy the installation of APKs from unknown sources on devices that handle company accounts. If an app outside the store is needed, it should go through IT and be documented.
2. Always verify the developer and the signature of the application before installing. A tampered copy may keep the icon and the name, but not the identity of the legitimate publisher.
3. Review which messaging apps are installed on the team's phones and uninstall duplicates, parallel versions or containers that no one knows where they came from.
4. Enable 2FA, yes, but with method: prefer codes generated in the app itself or physical keys over SMS, and do not enter credentials on devices we do not control.
5. Train the team on a simple rule: if a link asks you to install a Telegram or WeChat update outside the official store, it is an attack, not an update.

This case fits a trend we have been observing: the attacker no longer seeks so much to break cryptography as to slip in at the end where the user trusts. We saw it with the theft of the verification key in the case of Keystone and the 18,835 wallets, and we see it again here. Defense starts with the inventory: knowing what is installed on each device and through which channel it arrived.

For an SME, the good news is that this specific vector is cut off with digital hygiene and internal policy, without the need for large budgets. The bad news is that it requires consistency: reviewing, verifying and reminding the team that the convenience of a direct link can cost an entire account.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.