-
Researchers found a rentable Android spyware tool that can steal Telegram two-step passwords and read chats.
-
The toolkit hides bad code inside changed apps and runs WeChat inside a separate container app.
-
Its Telegram part shares technical clues with Baohuo, a backdoor tied to over 58,000 infected devices.
Security researchers have found a new rentable Android spyware tool called uCreator. Customers can rent it to attack messaging apps and mobile wallets. The tool can steal Telegram two-step passwords, pull out chat data, and clone WeChat accounts. Security researcher Ovi shared these findings on October 21, 2026, in a detailed report.
The platform also goes by the product name YingGai. It hides harmful code inside changed copies of real Android apps. Victims may install these apps from unofficial download sites. They may also fall for a social engineering trick that pushes them to install it. Social engineering means tricking people into doing something unsafe. Another method uses a container app named Onion Box. This container app runs other apps inside its own environment.
How the Spyware Takes Over Accounts
Ovi found that uCreator can catch the Telegram two-step password early. It grabs the password before the app scrambles it to make a login proof. Scrambling turns a password into a jumbled code. That step gives the attacker the password in plain, readable form. In simple terms, the attacker does not have to crack anything. The two-step password is the extra lock on a Telegram account.
The spyware can also search Telegram’s message database. This lets it pull out full chat histories. It can control active sessions too. A session is a logged-in device linked to an account. The attacker can hide their own session from the device list that the changed app shows. The tool can also change the linked phone number or delete the account. Some moves can leave victims locked out while the attacker’s session stays active.
The WeChat part works in a different way. It runs the app inside a virtual environment, which is a separate space inside the phone. It then collects login details and packs the app data. Next, it uploads that data to servers that the operators control. A bundled script then helps clone the account.
In a separate WeChat-related threat, a researcher reported last month a worm that could hijack accounts through unanswered calls, highlighting another way attackers may target the messaging platform.
Ovi also found code that supports about 20 apps. The list includes WhatsApp, LINE, Zalo, KakaoTalk, Viber, QQ, WeCom, GCash, and MoMo. However, Ovi published a deep technical review only for the Telegram and WeChat parts. The longer list shows what the tool might do. It does not prove that attackers broke into every listed service.
Link to Baohuo Backdoor Remains Unconfirmed
The probe also found a link between uCreator’s Telegram part and Baohuo. Baohuo is an Android backdoor, which is a hidden way into a device. Doctor Web reported on it on October 23, 2025. That report came about one year before Ovi published the uCreator findings.
Doctor Web is a security company. It found Baohuo inside changed versions of Telegram X, which is a version of the Telegram app. It estimated that more than 58,000 devices were infected. Its analysis listed stolen account details, chat histories, and hidden Telegram sessions.
According to reports, the two probes share the same code name, com.ucreator.tgjar. They also share a command server and matching command names. A command server is the computer that sends orders to infected devices. These overlaps support a technical link between the two malware samples.
However, neither probe shows whether uCreator’s makers ran the Baohuo attack. Neither shows whether a customer used the rental toolkit for it. So readers must not treat the 58,000 estimate as uCreator’s confirmed victim count.
Ovi also tested the toolkit on a Pixel 10 Pro running Android 17. Its hooking engine failed to find an internal Android function that it needed. Hooking means a tool attaches itself to apps to watch or change what they do. However, another tool called Frida could still hook apps on the phone. Ovi ran this test on one phone model and one Android version. This test does not show that Android 17 blocks the spyware.
Researchers Warn Against Unofficial App Downloads
Ovi traced parts of the platform’s setup to three companies in China’s Hunan province. However, the evidence linking them to a single owner is unclear. The probe also found back-end code for a rental system. It lets customers send commands to target devices and run operations from far away.
Ovi could not find a reliable victim count. Some recovered server data pointed to victims in China and the United States. Server data is information that the researcher pulled from the platform’s computers. But the proof was too weak to measure the full impact of the platform.
Users should install messaging apps from official sources only. This matters because the platform spreads through unofficial downloads and social engineering. They should also avoid APK files promoted through shady ads or unofficial websites.
An APK is the setup file for an Android app. Anyone who suspects an infection should stop using the affected app. They should then remove the untrusted install. Finally, they should secure their accounts from a verified, clean device. A clean device is one that does not carry the untrusted install.
