Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Rentable Android spyware targets sideloaded Telegram and WeChat

2 sources · 2 articlesFirst reported Updated ()2
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Researchers describe a rentable Android spyware kit in sideloaded apps, with capabilities documented but victim totals unconfirmed.

Researcher Ovi describes a rentable Android spyware platform, called uCreator by The Hacker News and uCreater by Security Affairs, hidden in sideloaded or repackaged apps rather than official stores. It targets working copies of Telegram and WeChat, and Security Affairs also names GCash among about 20 supported apps. The Hacker News says its Telegram code, namespace, command server and command names match Baohuo spyware previously linked by Doctor Web to more than 58,000 infected devices. Security Affairs says the YingGai framework can collect chats, contacts and one-time passwords, manipulate sessions and spoof camera checks, with target code fetched after installation. Both outlets say end-to-end use, operator-customer links and a reliable victim count are unconfirmed.

Key facts
  • The Hacker News spells the kit uCreator; Security Affairs spells it uCreater.
  • Shared Telegram indicators include namespace com.ucreator.tgjar, a command server and command names.
  • Doctor Web mapped Baohuo infections: India 22.8%, Brazil 20.5%, Indonesia 9.6%.
  • Security Affairs counts about 20 target apps and roughly 48 Tengine gateway hosts.
  • A July 29, 2026 sample still used the older hooking engine, The Hacker News says.
  • cache/lspatch/origin/*.apk or TgJarPine.dex can indicate infection, according to Security Affairs.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Jul 29, 2026Newest studied sample still used the older hooking engine. · The Hacker News

What each outlet adds

beyond the shared facts
  • The Hacker NewsLinks the Telegram module to Baohuo and Doctor Web’s infection map.
  • Security AffairsDetails YingGai, post-install payload hosting, app count and host indicators.
Products
TelegramWeChatGCashTelegram XOnion Box
Malware
uCreaterYingGaiuCreatorBaohuo
Organizations
Hunan Youchuang TechnologyChangsha Sukai NetworkChangsha Zhuoqing E-commerceDoctor Web
Countries
ChinaThailandUnited StatesIndiaBrazilIndonesia

Coverage

oldest first · one row per article · UTC
  1. · 4d ago The Hacker NewsFirst report

    uCreator Android spyware steals Telegram 2FA and clones WeChat

    The rentable kit hides in sideloaded Telegram and WeChat copies; its code and C2 match Doctor Web’s Baohuo.

  2. · 4d ago Security Affairs

    Rentable Android spyware uCreater targets WeChat, Telegram and wallets

    YingGai hooks sideloaded apps to steal chats, OTPs and wallet data and can spoof camera checks.