uCreator Spyware Steals Telegram 2FA and Clones WeChat

Researcher Ovi identified uCreator, a rentable Android spyware kit that steals Telegram two-factor authentication passwords and clones WeChat accounts. The kit operates by hiding code inside working copies of these applications. It affects users who install tampered app copies spread outside official stores or run WeChat inside the kit makers' container app, Onion Box. Some tampered Telegram X copies use the same package name as the real app on Google Play, making them difficult to identify by name alone.

The Telegram component of uCreator matches a backdoor called Baohuo reported by Doctor Web in October 2025. Comparisons show uCreator and Baohuo share the same code namespace, command-and-control server, and command names. Doctor Web found Baohuo spreading since mid-2024 via in-app ads leading to fake app store sites. Baohuo copies were also found in third-party stores including APKPure, ApkSum, and AndroidP. Ovi published his analysis on October 21, 2026, without mentioning Doctor Web's findings.

With the stolen 2FA password, the code can reset account sessions, change linked phone numbers, delete accounts, or lock out owners while keeping the attacker's session alive. The kit leaves two reliable traces on a phone: a code file named TgJarPine.dex and an original app copy left by LSPatch in the cache directory. The newest sample of the kit was dated July 29, 2026, and still carried the old hooking engine despite Android version changes.