# uCreator (YingGai) Android Spyware Kit Steals Telegram 2FA Passwords and Clones WeChat Accounts

> uCreator (internal name YingGai) is an Android spyware kit delivered as tampered copies of Telegram, Telegram X, WeChat and other messaging apps via fake app-store sites, malicious ads and third-party app catalogs. It hooks Telegram to capture the two-step-verification password before hashing, resets and hides attacker sessions, dumps chat history, and clones WeChat accounts using a virtualization container; code exists for about 20 apps. Attribution to three Hunan, China companies is plausible but unproven.

- **Published:** 2026-10-26T11:18:07Z
- **Last reviewed:** 2026-10-26T11:18:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4447
- **ID:** TL-2026-4447
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

uCreator, internally named YingGai, is a modular Android spyware platform analyzed by researcher Ovi (published 2026-10-21) and reported by The Hacker News on 2026-10-26. Victims receive repackaged copies of legitimate messaging apps (Telegram, Telegram X, WeChat, GCash and others) through sideloading, fake app-store sites, ads that promoted Telegram X as a dating/video-chat app, and third-party catalogs (APKPure, ApkSum, AndroidP). Some samples reuse legitimate Google Play package names (org.telegram.messenger.web, org.thunderdog.challegram). The kit contains code for roughly 20 apps (Telegram, WeChat, WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber, GCash, MoMo); detailed modules were documented only for Telegram and WeChat.

Instrumentation is delivered by repackaging with LSPatch (the original APK is cached at cache/lspatch/origin/_.apk) or by injecting assets/TgJarPine.dex. Hooking uses the Pine inline-hook engine on ART methods and a stock Xposed-style entry point that starts a compat layer, a local command server and a Redis subscriber. Target-specific hook code (Huuk_<target>) is pulled after installation from Alibaba OSS and MinIO buckets, which helps evade static analysis. Each hooked app hosts a local HTTP server (com.ucreator.syncsocketlib.server.http) with about 40 numbered handlers that run in the app's own process and identity.

The Telegram module hooks SRPHelper.getX to capture the 2FA password in cleartext before hashing, stores it in preferences and sends account data to the C2 about every three minutes. It resets logged-in sessions, changes linked phone numbers, hides attacker sessions from device lists, and runs operator-supplied SQL against the app's MessagesStorage database to extract chat history. The WeChat module runs an unmodified WeChat inside a VirtualApp-based container (com.ucreator.va_vx, 'Onion Box'), extracts login identity (_2_0_UploadAppLoginInfo), zips and uploads app data to OSS, and uses a bundled login script (LoginWeChat_v1.0.1.js) to clone the account on attacker devices.

C2 uses signed JSON POST beacons to hpncallback.gold5play.com and hpncallback.qianxunlbs.com (/api/callback/Tg* endpoints), three Redis instances (Aliyun and two Huawei Cloud IPs) acting as a command bus, and two MQTT endpoints (kfpt, ops-yunguan). The Redis key Domain:Basics holds callback-domain configuration, with a hardcoded fallback. A backend 'account cultivation' (yang hao) scheduler applies hourly windows, randomized daily caps and per-account budgets so hijacked-account activity looks human and passes platform risk controls. A relay at 43.225.141.209 and a SOCKS5 resource API (s5.ips5.cn) were also observed. The related Baohuo backdoor (Dr.Web, Android.Backdoor.Baohuo.1.origin, reported October 2025) shares the Redis and hpncallback.gold5play.com infrastructure, spread through fake ads in Brazil and Indonesia, and Dr.Web estimated 58,000+ infected devices (India 22.8%, Brazil 20.5%, Indonesia 9.6%).

Attribution: Ovi ties components to three Changsha/Hunan entities via ICP filings, certificates and signing identities (Hunan Youchuang Technology, Changsha Sukai Network, Changsha Zhuoqing E-commerce), and a leaked GitLab backend showed about 30 developers on UTC+8 with commits through October 2026. Shared ownership is described as plausible but unproven. Newest sample dated 2026-07-29. Several C2 domains stopped resolving by 2026-10-23. Android 17 removed an internal function the Pine engine relied on, but tested samples still carried outdated hooking code. Source gaps: it is unconfirmed whether hidden sessions appear on untampered clients, and no victim recovery steps were published. Severity is analyst judgment; no CVE or CVSS applies.

## MITRE ATT&CK

- T1474.003 Compromise Software Supply Chain
- T1204.002 User Execution: Malicious File
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1407 Download New Code at Runtime
- T1617 Hooking
- T1628 Hide Artifacts
- T1617 Hooking
- T1635 Steal Application Access Token
- T1418 Software Discovery
- T1533 Data from Local System
- T1636.003 Protected User Data: Contact List
- T1636.004 Protected User Data: SMS Messages
- T1414 Clipboard Data
- T1532 Archive Collected Data
- T1437.001 Application Layer Protocol: Web Protocols
- T1481 Web Service
- T1604 Proxy Through Victim
- T1646 Exfiltration Over C2 Channel
- T1640 Account Access Removal

## Sources

- [uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts](https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html)
- [uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps](https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/)
- [Doctor Web: Android.Backdoor.Baohuo.1.origin virus description](https://vms.drweb.com/virus/?i=30931101&lng=en)
- [Doctor Web malware IOC repository: Android.Backdoor.Baohuo.1.origin](https://github.com/DoctorWebLtd/malware-iocs/blob/master/Android.Backdoor.Baohuo.1.origin/README.adoc)
- [MITRE ATT&CK for Mobile](https://attack.mitre.org/matrices/mobile/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4447