uCreator

uCreator Android Spyware Kit Targets Telegram and WeChat Accounts

Researcher Ovi has analyzed a rentable Android spyware kit named uCreator that disguises malicious code within working copies of Telegram and WeChat. The malware targets users who install these tampered app versions outside official stores or run WeChat within the kit maker's container application. The uCreator Telegram component has been identified as matching the Baohuo backdoor, a known threat actor tool. The operation relies on sideloading disguised app copies rather than exploiting a vulnerability in the legitimate applications themselves.