Threat reportMalwareTL-2026-4447
uCreator (YingGai) Android Spyware Kit Steals Telegram 2FA Passwords and Clones WeChat Accounts
uCreator (YingGai) Android Spyware Kit Steals Telegram 2FA (TL-2026-4447), also tracked as YingGai, is a high-severity malware campaign, first published 2026-10-26. It has no confirmed attribution, affects Telegram Telegram / Telegram X for Android (tampered copies), maps to 18 MITRE ATT&CK techniques (T1204.002, T1407, T1414), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-4447
- Threat ID
- TL-2026-4447
- Also known as
- YingGai, uCreator, Onion Box (container component)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- telecoms, finance, general-consumer
- Target regions
- india, brazil, indonesia, china, Southeast Asia
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in uCreator (YingGai) Android Spyware Kit Steals Telegram 2FA
Malware and tooling: telegram
How uCreator (YingGai) Android Spyware Kit Steals Telegram 2FA works
uCreator (internal name YingGai) is an Android spyware kit delivered as tampered copies of Telegram, Telegram X, WeChat and other messaging apps via fake app-store sites, malicious ads and third-party app catalogs. It hooks Telegram to capture the two-step-verification password before hashing, resets and hides attacker sessions, dumps chat history, and clones WeChat accounts using a virtualization container; code exists for about 20 apps. Attribution to three Hunan, China companies is plausible but unproven.
uCreator, internally named YingGai, is a modular Android spyware platform analyzed by researcher Ovi (published 2026-10-21) and reported by The Hacker News on 2026-10-26. Victims receive repackaged copies of legitimate messaging apps (Telegram, Telegram X, WeChat, GCash and others) through sideloading, fake app-store sites, ads that promoted Telegram X as a dating/video-chat app, and third-party catalogs (APKPure, ApkSum, AndroidP). Some samples reuse legitimate Google Play package names (org.telegram.messenger.web, org.thunderdog.challegram). The kit contains code for roughly 20 apps (Telegram, WeChat, WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber, GCash, MoMo); detailed modules were documented only for Telegram and WeChat.
Instrumentation is delivered by repackaging with LSPatch (the original APK is cached at cache/lspatch/origin/_.apk) or by injecting assets/TgJarPine.dex. Hooking uses the Pine inline-hook engine on ART methods and a stock Xposed-style entry point that starts a compat layer, a local command server and a Redis subscriber. Target-specific hook code (Huuk_<target>) is pulled after installation from Alibaba OSS and MinIO buckets, which helps evade static analysis. Each hooked app hosts a local HTTP server (com.ucreator.syncsocketlib.server.http) with about 40 numbered handlers that run in the app's own process and identity.
The Telegram module hooks SRPHelper.getX to capture the 2FA password in cleartext before hashing, stores it in preferences and sends account data to the C2 about every three minutes. It resets logged-in sessions, changes linked phone numbers, hides attacker sessions from device lists, and runs operator-supplied SQL against the app's MessagesStorage database to extract chat history. The WeChat module runs an unmodified WeChat inside a VirtualApp-based container (com.ucreator.va_vx, 'Onion Box'), extracts login identity (_2_0_UploadAppLoginInfo), zips and uploads app data to OSS, and uses a bundled login script (LoginWeChat_v1.0.1.js) to clone the account on attacker devices.
C2 uses signed JSON POST beacons to hpncallback.gold5play.com and hpncallback.qianxunlbs.com (/api/callback/Tg* endpoints), three Redis instances (Aliyun and two Huawei Cloud IPs) acting as a command bus, and two MQTT endpoints (kfpt, ops-yunguan). The Redis key Domain:Basics holds callback-domain configuration, with a hardcoded fallback. A backend 'account cultivation' (yang hao) scheduler applies hourly windows, randomized daily caps and per-account budgets so hijacked-account activity looks human and passes platform risk controls. A relay at 43.225.141.209 and a SOCKS5 resource API (s5.ips5.cn) were also observed. The related Baohuo backdoor (Dr.Web, Android.Backdoor.Baohuo.1.origin, reported October 2025) shares the Redis and hpncallback.gold5play.com infrastructure, spread through fake ads in Brazil and Indonesia, and Dr.Web estimated 58,000+ infected devices (India 22.8%, Brazil 20.5%, Indonesia 9.6%).
Attribution: Ovi ties components to three Changsha/Hunan entities via ICP filings, certificates and signing identities (Hunan Youchuang Technology, Changsha Sukai Network, Changsha Zhuoqing E-commerce), and a leaked GitLab backend showed about 30 developers on UTC+8 with commits through October 2026. Shared ownership is described as plausible but unproven. Newest sample dated 2026-07-29. Several C2 domains stopped resolving by 2026-10-23. Android 17 removed an internal function the Pine engine relied on, but tested samples still carried outdated hooking code. Source gaps: it is unconfirmed whether hidden sessions appear on untampered clients, and no victim recovery steps were published. Severity is analyst judgment; no CVE or CVSS applies.
MITRE ATT&CK techniques used in TL-2026-4447
Execution
T1204.002 User Execution: Malicious File
Defense Evasion
T1407 Download New Code at Runtime; T1617 Hooking; T1628 Hide Artifacts; T1655.001 Masquerading: Match Legitimate Name or Location
Collection
T1414 Clipboard Data; T1532 Archive Collected Data; T1533 Data from Local System; T1636.003 Protected User Data: Contact List; T1636.004 Protected User Data: SMS Messages
Discovery
Command and Control
T1437.001 Application Layer Protocol: Web Protocols; T1481 Web Service
Initial Access
T1474.003 Compromise Software Supply Chain
defense-evasion
T1604 Proxy Through Victim; T1617 Hooking
Credential Access
T1635 Steal Application Access Token
Impact
Exfiltration
Affected products and versions in uCreator (YingGai) Android Spyware Kit Steals Telegram 2FA
- Telegram — Telegram / Telegram X for Android (tampered copies)
Vulnerable versions: Repackaged third-party copies, not the official builds
Fixed in: Official builds from Google Play or telegram.org - Tencent — WeChat for Android (run inside attacker VirtualApp container)
Vulnerable versions: Copies installed via the Onion Box container
Fixed in: Official builds from official stores - Various — WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber, GCash, MoMo (code for about 20 apps)
Vulnerable versions: Tampered copies only
Fixed in: Official builds from official stores
Remediation for uCreator (YingGai) Android Spyware Kit Steals Telegram 2FA
Patches
- No CVE or vendor patch applies; the kit abuses repackaging and hooking, not a vulnerability. Note Android 17 removed a function the bundled Pine engine relied on
Immediate actions
- Block hpncallback.gold5play.com, hpncallback.qianxunlbs.com, telegram-apk.uzyzx.com, hw.android.videoflow.cn and the listed Redis/relay IPs at DNS and egress
- Hunt managed Android devices for packages com.ucreator.*, com.uckj.tgx and any file assets/TgJarPine.dex or cache/lspatch/origin/*.apk
- For suspected Telegram victims, terminate all sessions from an untampered official client, rotate the 2FA password and re-verify the linked phone number
- For suspected WeChat victims, remove the tampered/container app, change credentials and review logged-in devices
Workarounds
- Uninstall tampered apps and reinstall official builds from Google Play or the vendor's site
- Remove sideloaded APKs from devices using sources such as APKPure, ApkSum or AndroidP
Longer-term hardening
- Block installation from unknown sources and enforce Play Protect on managed devices
- Use mobile threat defense/MDM to inventory app package names and signing certificates and flag apps whose signer differs from the official publisher
- Educate users to install messaging apps only from official stores and not from ad-promoted or third-party catalogs
Timeline of uCreator (YingGai) Android Spyware Kit Steals Telegram 2FA
- YingGai product line first appears in records (Ovi analysis; day approximate, source gives September 2021)
- Earliest tampered Telegram sample (July 2024); fake app-store ads for Baohuo variant active from mid-2024 in Brazil and Indonesia
- Tampered Telegram X samples observed (November 2024)
- Doctor Web initial detection of Android.Backdoor.Baohuo.1.origin
- Doctor Web publishes Baohuo report; estimated 58,000+ infected devices, hotspots India, Brazil, Indonesia
- Onion Box container sample dated March 2026
- Newest uCreator sample recovered; still carries outdated Pine hooking code
- Researcher Ovi publishes full uCreator technical analysis and attribution to three Hunan companies
- hpncallback.gold5play.com, hpncallback.qianxunlbs.com and telegram-apk.uzyzx.com no longer resolving
- The Hacker News reports on uCreator; developer commits continue through October 2026
Sources cited for uCreator (YingGai) Android Spyware Kit Steals Telegram 2FA
- uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts
- uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps
- Doctor Web: Android.Backdoor.Baohuo.1.origin virus description
- Doctor Web malware IOC repository: Android.Backdoor.Baohuo.1.origin
- MITRE ATT&CK for Mobile
Detection coverage for TL-2026-4447
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4447 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.