---
title: uCreator: a rentable Android "mass control" spyware kit that hides inside working copies of Telegram, WeChat and other apps, and steals OTPs and Telegram 2FA passwords | ctxsec
url: https://ctxsec.com/items/ucreator-android-spyware-platform-telegram-wechat-baohuo
description: ""
status: "researcher analysis (Ovi, Oct 21); link to Doctor Web's Baohuo per The Hacker News comparison (Oct 26)"
published: 2026-10-26
---

> 

[← Cybersecurity News](/news) · [markdown](/items/ucreator-android-spyware-platform-telegram-wechat-baohuo.md)

researcher analysis (Ovi, Oct 21); link to Doctor Web's Baohuo per The Hacker News comparison (Oct 26)

2026-10-26

### uCreator: a rentable Android "mass control" spyware kit that hides inside working copies of Telegram, WeChat and other apps, and steals OTPs and Telegram 2FA passwords

Researcher Ovi has documented **uCreator** (vendor name YingGai), a commercial Android surveillance platform rather than a single malware family. It combines a VirtualApp/LSPatch engine, per-app hook modules, a Redis/HTTP control plane, a cloud-phone farm for live screen control and a Windows operator console. Customers rent it and pick which apps to hook. Targets include WeChat, WeCom, QQ, Telegram, WhatsApp, LINE, Zalo, KakaoTalk, Viber, GCash and MoMo, with capabilities including OTP interception and account takeover.

The Hacker News compared Ovi's analysis with Doctor Web's Oct 2025 report on **Baohuo**, a backdoor in tampered Telegram X builds that infected more than 58,000 devices. The two share the `com.ucreator.tgjar` namespace, C2 server and command names. Victims get it by sideloading tampered apps (some reuse the real Google Play package name) or by running apps inside the kit makers' "Onion Box" container app.

**Do:** on managed Android, block sideloading and app-cloning/container apps, and check that Telegram and WeChat builds are signed by the real publisher, not just named like them.

Sources: [Ovi (0x0v1): uCreator, virtualization-based Android spyware platform (Oct 21)](https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/) · [Doctor Web: Baohuo backdoor in tampered Telegram X (Oct 2025)](https://news.drweb.com/show/?i=15076) · [The Hacker News: uCreator Android spyware can steal Telegram 2FA passwords and clone WeChat accounts (Oct 26)](https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html)