Threat reportMalwareTL-2026-4483
uCreater (uCreator / YingGai): Rentable Android Spyware Platform Targeting WeChat, Telegram and Mobile Wallets
uCreater (uCreator / YingGai) (TL-2026-4483), also tracked as uCreator, is a high-severity malware campaign, first published 2026-10-26. It has no confirmed attribution, affects Google Android (sideloaded repackaged apps), maps to 16 MITRE ATT&CK techniques (T1090.002, T1204, T1409), and is covered by 9 detection rules and 31 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 31Indicators of compromise
Key facts for TL-2026-4483
- Threat ID
- TL-2026-4483
- Also known as
- uCreator, YingGai, Onion Box
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, telecoms, general consumers
- Target regions
- china, Southeast Asia, philippines, united states of america
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in uCreater (uCreator / YingGai)
Malware and tooling: YingGai, telegram
How uCreater (uCreator / YingGai) works
uCreater (vendor product name YingGai) is a rentable, multi-tenant Android surveillance framework that uses app virtualization and no-root hooking (VirtualApp, LSPatch, Pine) to instrument repackaged messaging and wallet apps, intercepting OTPs, 2FA passwords, chats and contacts. Infrastructure and developer artifacts point to Changsha, Hunan, China; attribution to a state actor is unproven and the researcher assesses it as financially-motivated crimeware.
uCreater, tracked by its operators as YingGai and published by researcher Ovi (0x0v1) on 2026-10-21, is a productized Android spyware framework. It runs target apps (Telegram, Telegram-X, Telegram-Web, WeChat, WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber, MoMo, GCash and roughly 20 apps in total) inside a VirtualApp container or inside repackaged APKs patched with LSPatch, or injects hook code with the Pine ART inline-hook engine (for example from assets/TgJarPine.dex), so the spyware operates in-process with access to decrypted data without root. Distribution is via sideloaded modified APKs and social engineering.
Per-application hook modules expose roughly 40 numbered HTTP command handlers (IHttpDoc interface with getDesc()/getParam()). Documented capabilities include OTP and two-step-verification password capture (the Telegram module hooks SRPHelper.getX() to capture the 2FA password in cleartext), live SQLite queries against the app's encrypted database via reflection on MessagesStorage.database with no query whitelist, contact and address-book harvesting (contacts.vcf), chat history and cache upload, device-authorization enumeration and removal, account takeover and lockout, session manipulation, removal of operator traces, device fingerprinting and installed-app collection, and camera-feed spoofing to defeat identity (KYC) verification. WeChat automation uses LoginWeChat_v1.0.1.js and the _2_0_UploadAppLoginInfo command.
The control plane combines an HTTP callback API (TgHeartCallback, TgRegisterLogCallback, TgReceptionCommandCallback, TgInstallEventCallback, TgRedisStatusChange, hwversion/Upload), Redis buses on Aliyun and Huawei Cloud (key Domain:Basics resolves C2 callback domains), two MQTT buses, Aliyun OSS/MinIO buckets that stage hook payloads (Huuk_<TARGET>/tghuuk_PATCH002_updateinfo) and a SOCKS5 proxy service plus a Thailand relay on Huawei Cloud. A Windows operator console (uip.exe) and a multi-tenant merchant console with role-based access support renting the platform to many operators. Leaked GitLab commit history indicates a Spring Cloud/Kafka/RocketMQ/Nacos backend, account-cultivation features, and about three dozen developers working on UTC+8 timestamps. About 48 hosts were fingerprinted through Censys (Tengine gateway). Five samples were reported contacting control servers, with the latest sample dated 2026-07-29; victim counts are unconfirmed, though C2 artifacts reference victims in China and the United States. The researcher notes Android 17 (API 37) changes break captured Pine but in-process hooking remains viable.
Attribution: infrastructure, certificates and ICP filings tie the platform to three Changsha/Hunan companies: Hunan Youchuang Technology (ucreater.com, com.ucreator namespace), Changsha Sukai Network (ICP filer for qianxuncc.cn) and Changsha Zhuoqing E-commerce (Authenticode signer of uip.exe). A shared Tengine gateway co-tenancy with the Hunan Intelligent Police Public Safety Technology Research Institute was observed, but the researcher states there is no evidence the police developed or operated uCreater. Severity HIGH is analyst-assigned; no CVE or CVSS applies.
MITRE ATT&CK techniques used in TL-2026-4483
Command and Control
T1090.002 External Proxy; T1437.001 Web Protocols; T1544 Ingress Tool Transfer; T1571 Non-Standard Port
Execution
Collection
T1409 Stored Application Data; T1636.003 Contact List
Credential Access
Discovery
T1418 Software Discovery; T1426 System Information Discovery
Resource Development
T1587.001 Malware; T1608.001 Upload Malware
Defense Evasion
T1630 Indicator Removal on Host; T1655.001 Match Legitimate Name or Location
Exfiltration
T1646 Exfiltration Over C2 Channel
Initial Access
Affected products and versions in uCreater (uCreator / YingGai)
- Google — Android (sideloaded repackaged apps)
Vulnerable versions: Samples target Android up to 16; in-process hooking reported still viable on Android 17 (API 37) - Tencent — WeChat / WeCom / QQ
Vulnerable versions: Repackaged or virtualized builds - Telegram — Telegram, Telegram-X, Telegram-Web
Vulnerable versions: Repackaged builds - Various — WhatsApp, LINE, Zalo, KakaoTalk, Viber, MoMo, GCash
Vulnerable versions: Repackaged or virtualized builds
Remediation for uCreater (uCreator / YingGai)
Patches
- No vendor patch: this is malware, not a vulnerability. Keep Android and messaging apps updated from official stores only
Immediate actions
- Block and alert on DNS/HTTP to ucreater.com, qianxuncc.cn, videoflow.cn, hunanzhijing.com, gold5play.com and qianxunlbs.com callback hosts and the listed IPs
- Search MDM/EDR inventories for packages com.ucreator.tg, com.ucreator.tgjar, com.ucreator.va_yjb_client and com.ucreater.autotool and for /cache/lspatch/origin/*.apk
- For suspected infected devices, sign out all sessions, remove unknown authorized devices, rotate Telegram/WeChat/wallet credentials and 2FA passwords from a clean device
Workarounds
- Install messaging and wallet apps only from official stores or publisher sites and review linked devices regularly
- Treat Telegram/WeChat APKs received via chat, social media or file shares as untrusted
Longer-term hardening
- Restrict sideloading and unknown-source installs on managed Android devices
- Enforce Play Protect / mobile threat defense and verify app signing certificates of messaging apps against official publishers
- Do not rely on SMS OTP or camera-based KYC alone for high-value wallet actions; add device-binding and liveness checks resistant to camera-feed spoofing
Timeline of uCreater (uCreator / YingGai)
- Approximate origin of the com.ucreator.autotool package name (year only per source)
- YingGai mobile product line first appears in records (month per source)
- Repackaged Telegram samples begin appearing (July-November 2024)
- WeChat VirtualApp host (va_vx) and Telegram framework (com.ucreator.tg) builds observed
- Onion Box client (com.ucreator.va_yjb_client) observed (month per source)
- Latest malware sample dated; five samples reported contacting control servers
- 0x0v1 publishes technical analysis of uCreator/YingGai, noting active commits continue
- Security Affairs reports the findings on the rentable spyware platform
Sources cited for uCreater (uCreator / YingGai)
- uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps
- Researchers uncover rentable Android spyware uCreater targeting WeChat and Telegram
- VirtualApp (app virtualization engine abused by the platform)
- LSPatch (no-root Xposed-style APK patching used by the platform)
- Pine (ART inline-hook engine used by the platform)
- Trend Micro: ActionSpy, prior Android spyware using virtualization to target WeChat/Telegram data (related precedent)
Detection coverage for TL-2026-4483
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4483 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.