Analysis of the uCreator Android spyware kit reveals how tampered application copies of Telegram and WeChat intercept authentication credentials and clone user identities.
The toolkit utilizes containerized execution and custom hooks to bypass security boundaries, offering resellers a structured cloud management backend.
How the attack works
The software is hidden within working versions of the Telegram and WeChat apps. The Telegram part matches a hidden program that was discovered by security researchers in October 2025.
When the user types their Telegram password, the hidden program copies it right as it is typed, before it has a chance to be encrypted. With this password, the attackers can delete the account, change the linked phone number, or reset sessions.
For WeChat, the tool runs the regular app inside a special isolation environment, copies the login credentials, and clones the account.
How it reaches devices
Modified apps are distributed outside of official app stores, as users install them manually. Attacks are often based on deception and in-app ads that lead to fake app store websites.
READ ALSO
Automated campaign steals sensitive data from hundreds of accounts
The package also uses a container application called Onion Box, which allows other applications to run inside it. Researchers had detected similar samples spreading since mid-2024.
Who is affected and the infrastructure behind the tool
Researchers located the operating code on a server and uncovered a central console intended for merchants and resellers. The tool's creators refer to it as YingGai, with records showing activity dating back to September 2021.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
end of article
Top comments (0)