Rentable Android spyware uCreater targets WeChat, Telegram and wallets
Original title: Researchers Uncover Rentable Android Spyware uCreater Targeting WeChat and Telegram
YingGai hooks sideloaded apps to steal chats, OTPs and wallet data and can spoof camera checks.
Researcher Ovi describes uCreater, a rentable Android spyware platform hidden in repackaged apps such as Telegram, WeChat and GCash. Its YingGai framework can intercept one-time passwords, collect contacts and chats, manipulate sessions and spoof camera feeds. Target-specific code is fetched after installation from Alibaba OSS and MinIO. Victim totals and links between operators and customers are unconfirmed.
Unconfirmed: Victim counts, customer links, and any shared ownership or police role remain unproven.
- Package com.ucreater.autotool dates to about 2014; YingGai records start in September 2021.
- Samples studied run from 2024 through a March 2026 Onion Box client.
- Ovi counts about 20 supported target apps and roughly 48 Tengine gateway hosts.
- A local command server exposes about 40 handlers, including raw SQL on Telegram data.
- cache/lspatch/origin/*.apk or TgJarPine.dex can indicate an infected device.
Impact: Steals credentials, messages, OTPs, contacts and wallet data
- 1.Check devices for cache/lspatch/origin/*.apk or the TgJarPine.dex asset.
- 2.Avoid sideloaded or modified Telegram, WeChat and GCash packages.
- ATT&CK
- T1204.002 Malicious FileT1036.005 Match Legitimate Name or LocationT1111 Multi-Factor Authentication Interception
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | hunanzhijing.com | mmon owner is plausible but unproven. Another lead involves hunanzhijing.com, a domain belonging to the Hunan Intelligent Police Public |
| domain | qianxuncc.cn | holds the ICP filing for the control server’s main domain, qianxuncc.cn, while Changsha Zhuoqing E-commerce appears as the signing |
From the original article
7 min read at securityaffairs.com
uCreater is Android spyware disguised as trusted apps, stealing credentials, messages and wallet data through a rentable platform. uCreater is a rentable Android spyware platform that hides inside repackaged legitimate apps, targeting messaging services and mobile wallets. Its YingGai framework can intercept one-time passwords, steal account and chat data, collect contacts, manipulate sessions and spoof […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.