uCreater Android spyware targets WeChat and Telegram users

Security researchers have identified a rentable Android spyware platform known as uCreater that targets messaging services and mobile wallets. The malware operates by hiding malicious code within repackaged, legitimate-looking applications, such as modified versions of Telegram, Telegram X, and WeChat. These tampered apps can function normally and connect to official servers, making the infection difficult to detect.

Through its YingGai framework, uCreater can intercept one-time passwords, steal account credentials, and capture chat data. Notably, the kit can capture Telegram’s two-step verification passwords before they are hashed, potentially allowing attackers to compromise accounts without breaching the service's servers. For WeChat, the malware can run the application within a virtual container to extract data and support account cloning.

The platform follows a commercial rental model, making sophisticated spyware accessible to operators who lack the resources to develop their own tools. While the full geographic reach is unconfirmed, the apparent targets include users in China and Southeast Asia. Researchers have also found links between uCreater and the Baohuo Android backdoor, which reportedly infected over 58,000 devices by October 2025.