uCreator can take over Telegram and WeChat accounts, researcher says
Ovi’s October 21 analysis describes how malicious code inside working Android apps can intercept Telegram passwords and copy WeChat account data for cloning.
Loading… Բեռնվում է…
Ovi’s October 21 analysis describes how malicious code inside working Android apps can intercept Telegram passwords and copy WeChat account data for cloning.
A rentable Android spyware kit called uCreator can intercept Telegram passwords and clone WeChat accounts by operating inside apps that appear to work normally, researcher Ovi found in an analysis published October 21, 2026. The findings establish technical capabilities, not that attackers have used every takeover step from start to finish.
The Telegram component has an earlier counterpart. In October 2025, Doctor Web estimated that a backdoor called Baohuo, found in tampered Telegram X apps, had infected more than 58,000 devices. The Hacker News compared the analyses and found matching code identifiers, a server used to control infected apps, and commands. The 58,000 figure is Doctor Web’s historical Baohuo estimate, not a current uCreator victim count.
Exposure requires installing a tampered app or running WeChat inside the kit makers' container app, Onion Box. A container runs another app within its own environment; in this case, that gives the spyware a way to interfere with WeChat even when the WeChat app itself is unchanged.
Ovi identified sideloading—installing an app file directly rather than through an app store—and deception used to persuade people to install it as distribution methods. He could not confirm every victim’s infection route. Some altered Telegram X copies use the genuine app’s package name, its identifying name on Android, so that name alone does not establish that a copy is genuine.
Inside a tampered Telegram app, the malicious code starts with the app and uses its identity and permissions, Ovi found. It therefore has the access of the signed-in app, including the ability to retrieve chat history from the app’s message database.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
Telegram’s two-step verification adds a password to the login process. The app processes that password on the phone to produce proof for a login. Ovi found that uCreator intercepts this processing and copies the readable password before the app hashes it—turns it into a derived value. The interception happens inside the compromised app, rather than by breaking the password’s protection elsewhere.
Ovi found code that can use the password to reset logged-in sessions, change the linked phone number or delete the account. Other code is designed to lock out the owner while retaining the attacker’s access. It can also hide the attacker’s session, or logged-in connection, from the device list shown by the tampered app. Whether that session remains visible in other, untampered Telegram apps is unresolved.
For WeChat, Ovi found that the kit can extract login identity and account data from the app running inside its container, then use that data to clone the account. This component targets control of the account itself, rather than its chat history.
Ovi’s examination of exposed back-end code also showed a rental console for merchants and resellers. Commands carry a customer identifier, allowing customers to direct their own share of the phones controlled through the system. The code includes tools to capture login authorizations, collect contacts and profiles, add friends in bulk and back up accounts. The exposed back end covered WeChat; Ovi said it did not appear to cover Telegram.
Analysis
On a phone running Android 17, the kit’s interception engine could not find an internal Android function it needed. Ovi described that failure as extra work for the kit’s makers, not proof that Android 17 blocks the attack: another tool could still perform the same kind of interception on that phone. He recovered samples built for Android 16 but did not report testing that version, and he did not test phones from Chinese manufacturers.
Data from a command server Ovi accessed was insufficient for a reliable victim count. He described his work as an analysis of capability rather than a measurement of victim impact. The available account-takeover code therefore does not establish how often, or how completely, those capabilities were used.
Ovi linked parts of the operation to three companies in Hunan province, China, through website, server and software-signing records. He said shared ownership was plausible but unproven. Whether the kit’s makers or a customer ran the Baohuo campaign also remains unresolved. The code history showed developers still making changes in October 2026.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min