Android users are facing a new class of mobile threat that doesn't need a zero-day or a clever exploit chain. Instead, a rentable spyware kit dubbed uCreator simply wraps working copies of Telegram and WeChat in tampered packages, letting operators walk away with two-factor authentication codes, chat data, and even full control of a victim's WeChat identity.

The findings come from independent researcher Ovi, who documented the kit's mechanics in a report covered by The Hacker News. The research highlights how commodity malware is increasingly targeting the messaging apps people trust most, turning legitimate installers into surveillance tools.

How the Infection Actually Works

Nothing about uCreator relies on remote code execution against the official apps. The kit ships modified builds of Telegram and WeChat that look and behave like the real thing, but carry hidden surveillance code. Victims only get exposed if they install one of these repackaged APKs, which are distributed outside Google Play and other official app stores, or if they run WeChat through the kit operators' own container application.

That distribution model is both the kit's biggest limitation and its main selling point. It won't spread on its own, but it requires almost no technical skill from the operator beyond convincing a target to sideload an app or adopt a third-party container. In social-engineering-heavy targeting, such as romance scams, business email compromise, or surveillance of specific individuals, that tradeoff is often acceptable.

What the Spyware Takes

The stolen data is substantial. According to the research, uCreator is built to capture Telegram two-factor authentication passwords, giving operators a path into accounts even when SMS-based or app-based 2FA is enabled. For WeChat, the kit goes further: it can clone accounts, effectively letting an attacker operate as the victim within the messaging platform.

That capability matters because WeChat is both a communication channel and, for hundreds of millions of users, a payment and identity platform. Account cloning can enable fraud against contacts, access to linked financial services, and long-term persistent access that outlives a single device compromise.

Ties to the Baohuo Backdoor

Ovi's analysis found that the Telegram component of uCreator matches Baohuo, a backdoor previously documented by Doctor Web. The overlap suggests the kit is assembled from existing, proven components rather than built from scratch, a pattern common in the mobile malware economy. Reusing a known backdoor lowers development costs for the kit's authors and speeds up deployment for customers who rent it.

The Baohuo attribution also gives defenders a head start. Detection logic, indicators of compromise, and behavioral signatures published for Baohuo can often be adapted to catch uCreator's Telegram payload, even as the kit evolves.

A Rentable Kit, Not a Campaign

The framing matters here. uCreator is described as a rentable spyware kit, meaning it is sold or leased to multiple operators rather than run by a single criminal group. That model fragments the threat: there is no single command-and-control infrastructure to sinkhole and no single actor to attribute attacks to. Victims in different regions may be targeted by completely unrelated operators using identical tooling.

Rental malware also tends to iterate quickly. When many customers use the same kit, bug reports and feature requests drive rapid updates, and the codebase becomes more polished over time.

Practical Defenses

Because uCreator depends on sideloading and unofficial containers, the most effective controls are distribution-focused:

  • Stick to official app stores for Telegram, WeChat, and all messaging clients. Avoid APKs from forums, file-sharing links, or chat groups.
  • Treat third-party container apps with suspicion, especially those that promise to run WeChat or other regional apps on devices where they aren't officially available.
  • Verify app signatures and package names in enterprise mobile device management (MDM) environments, and block sideloading where policy allows.
  • Review 2FA methods. Since uCreator targets Telegram 2FA passwords, users should consider hardware security keys or passkeys where supported, and review active sessions for unfamiliar devices.
  • Watch for account anomalies such as unexpected logouts, messages sent to contacts without the user's knowledge, or new devices appearing in WeChat's linked-device list.

The Bigger Picture

Mobile spyware is shifting away from exotic exploits and toward the simplest possible path: convincing a user to install something. uCreator shows that even well-protected apps like Telegram and WeChat can be undermined when attackers control the installer. For security teams, the takeaway is that endpoint and mobile threat defense must cover sideloaded applications and container apps, not just official store installs.

Users should also be cautious of anyone urging them to install a "special version" of a messaging app, whether framed as a work requirement, a regional workaround, or a feature-enhanced build. In the uCreator economy, that request is often the entire attack.