uCreator Android Spyware Kit Targets Telegram and WeChat Accounts

A new rentable Android spyware kit identified as uCreator has been found targeting users of Telegram and WeChat. According to researcher Ovi, the malware operates by embedding malicious code inside functional, tampered copies of both messaging applications. These modified versions are not distributed through official app stores but are instead sideloaded by users or obtained from third-party sources.

The uCreator kit's integration with Telegram has been analyzed as matching the Baohuo backdoor, a previously identified credential-stealing and access-maintaining malware. For WeChat, the kit leverages a container app approach provided by the malware's operators, forcing the messaging app to run within this controlled environment to facilitate account access and cloning.

The primary infection vector requires user interaction: victims must install one of the disguised app copies or run WeChat inside the kit maker's container application. Once active, the spyware targets account credentials and two-factor authentication passwords, potentially allowing unauthorized access and cloning of the affected accounts. The campaign's reach is limited to those who install these specific tampered versions, mitigating widespread impact but posing a significant risk to affected users.

Security researchers emphasize that the discovery underscores the ongoing threat of disguised malware targeting popular communication platforms. Users are advised to exercise caution when installing applications from outside official channels and to verify the authenticity of app updates.