uCreator Android spyware steals Telegram 2FA and clones WeChat
Original title: uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts
The rentable kit hides in sideloaded Telegram and WeChat copies; its code and C2 match Doctor Web’s Baohuo.
Researcher Ovi says the rentable uCreator kit embeds code in working Telegram and WeChat copies or runs WeChat inside the makers’ Onion Box container. It reaches people who sideload those copies or use that container, not official stores. The Telegram module matches Baohuo, which Doctor Web linked to more than 58,000 infected devices. Ovi says the report measures capability, not confirmed end-to-end use or a reliable victim count.
Unconfirmed: It is unclear whether kit makers or a customer ran the Baohuo campaign, and Ovi does not confirm every capability was used.
- Baohuo and uCreator share namespace com.ucreator.tgjar, a C2 server, and command names.
- Doctor Web mapped infections with India at 22.8%, Brazil 20.5%, and Indonesia 9.6%.
- The newest sample, dated July 29, 2026, still used the older hooking engine.
- Ovi’s command server held apparent China and US victim data, too little to count.
- For WeChat, the kit zips app data and uses a login script to clone the account.
Impact: Telegram 2FA theft and WeChat account cloning
- 1.Avoid sideloaded Telegram and WeChat copies and third-party stores such as APKPure
- ATT&CK
- T1204.002 User Execution: Malicious FileT1036.005 Masquerading: Match Legitimate Name or LocationT1056 Input Capture
- Organizations
- Doctor Web
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aliyuncs.com | 79 (Redis server) Domain : r-bp1jehsclgbuu48m7tpd.redis.rds.aliyuncs[.]com:65531 (Redis server, WeChat part) IP : 43.225.141[.]209 ( |
| domain | gold5play.com | 3a1 (uip.exe, Windows control program) Domain : hpncallback.gold5play[.]com (command server, not resolving on October 23) Domain : hp |
| domain | qianxunlbs.com | d server, not resolving on October 23) Domain : hpncallback.qianxunlbs[.]com (command server, not resolving on October 23) Domain : te |
| domain | uzyzx.com | server, not resolving on October 23) Domain : telegram-apk.uzyzx[.]com (download host, not resolving on October 23) Domain : hw. |
| domain | videoflow.cn | load host, not resolving on October 23) Domain : hw.android.videoflow[.]cn (version uploads, pointing to 121.37.194[.]194 on October |
| ipv4 | 121.37.194.194 | . The domain for its version-upload server still pointed to 121.37.194[.]194 . The kit's indicators include: SHA-256 : 2fc4bad71eda25b |
| ipv4 | 159.138.229.12 | October 23) IP : 159.138.237[.]10:32115 (Redis server) IP : 159.138.229[.]12:26379 (Redis server) Domain : r-bp1jehsclgbuu48m7tpd.redi |
| ipv4 | 159.138.237.10 | n uploads, pointing to 121.37.194[.]194 on October 23) IP : 159.138.237[.]10:32115 (Redis server) IP : 159.138.229[.]12:26379 (Redis s |
| ipv4 | 43.225.141.209 | s.rds.aliyuncs[.]com:65531 (Redis server, WeChat part) IP : 43.225.141[.]209 (relay used by the Telegram part) URL : kfpt.oss-cn-hangz |
| sha256 | 0142749a159be3e41d28f910eebf28b577a282880bd0c2383bd7404189f4ff94 | (com.ucreator.tg, framework and command handlers) SHA-256 : 0142749a159be3e41d28f910eebf28b577a282880bd0c2383bd7404189f4ff94 (com.uckj.tgx, loader) SHA-256 : dcec9640271a782553599197bc |
| sha256 | 2fc4bad71eda25b9022ea7cb090d6419911ecd67e50e746b418f8a617a980301 | 121.37.194[.]194 . The kit's indicators include: SHA-256 : 2fc4bad71eda25b9022ea7cb090d6419911ecd67e50e746b418f8a617a980301 (com.ucreator.tg, framework and command handlers) SHA-256 : |
| sha256 | 805834e6b8c12e180117a1816b48e387c33b53520f5a91cbf858441dc895e717 | g.challegram, tampered Telegram X, November 2024) SHA-256 : 805834e6b8c12e180117a1816b48e387c33b53520f5a91cbf858441dc895e717 (org.telegram.messenger.web, tampered Telegram, July 2024) |
| sha256 | 99c5be579d218acfd2c7e2662528e7ad32a1a605d8efd1da732c13931bc30c4c | 76b3166ba66bb20 (com.ucreator.va_vx, WeChat host) SHA-256 : 99c5be579d218acfd2c7e2662528e7ad32a1a605d8efd1da732c13931bc30c4c (com.ucreator.va_yjb_client, Onion Box) SHA-256 : 9c8b147f7 |
| sha256 | 9c8b147f76312e651faabb1411a3270efca984dd8f33bd8ded3ea611c7c583a1 | 31bc30c4c (com.ucreator.va_yjb_client, Onion Box) SHA-256 : 9c8b147f76312e651faabb1411a3270efca984dd8f33bd8ded3ea611c7c583a1 (uip.exe, Windows control program) Domain : hpncallback.gol |
| sha256 | a90e3ab2b5cf306439a378faf7107a89196116ad7ee4ad5791c2ba8839ba21c4 | gram.messenger.web, tampered Telegram, July 2024) SHA-256 : a90e3ab2b5cf306439a378faf7107a89196116ad7ee4ad5791c2ba8839ba21c4 (org.thunderdog.challegram, tampered Telegram X) SHA-256 : |
| sha256 | dcec9640271a782553599197bcb85367971a5bb4aa84c3787d1e49a3f4f9420e | 880bd0c2383bd7404189f4ff94 (com.uckj.tgx, loader) SHA-256 : dcec9640271a782553599197bcb85367971a5bb4aa84c3787d1e49a3f4f9420e (org.thunderdog.challegram, tampered Telegram X, November 2 |
| sha256 | f82ac2c525d1ed82e57b3f27ae689aeda46875a893ca4c42876b3166ba66bb20 | (org.thunderdog.challegram, tampered Telegram X) SHA-256 : f82ac2c525d1ed82e57b3f27ae689aeda46875a893ca4c42876b3166ba66bb20 (com.ucreator.va_vx, WeChat host) SHA-256 : 99c5be579d218ac |
From the original article
7 min read at thehackernews.com
A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the kit makers' own container app. The kit's Telegram part matches Baohuo, a backdoor that Doctor
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.