# uCreater (uCreator / YingGai): Rentable Android Spyware Platform Targeting WeChat, Telegram and Mobile Wallets

> uCreater (vendor product name YingGai) is a rentable, multi-tenant Android surveillance framework that uses app virtualization and no-root hooking (VirtualApp, LSPatch, Pine) to instrument repackaged messaging and wallet apps, intercepting OTPs, 2FA passwords, chats and contacts. Infrastructure and developer artifacts point to Changsha, Hunan, China; attribution to a state actor is unproven and the researcher assesses it as financially-motivated crimeware.

- **Published:** 2026-10-26T20:15:06Z
- **Last reviewed:** 2026-10-26T20:15:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4483
- **ID:** TL-2026-4483
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

uCreater, tracked by its operators as YingGai and published by researcher Ovi (0x0v1) on 2026-10-21, is a productized Android spyware framework. It runs target apps (Telegram, Telegram-X, Telegram-Web, WeChat, WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber, MoMo, GCash and roughly 20 apps in total) inside a VirtualApp container or inside repackaged APKs patched with LSPatch, or injects hook code with the Pine ART inline-hook engine (for example from assets/TgJarPine.dex), so the spyware operates in-process with access to decrypted data without root. Distribution is via sideloaded modified APKs and social engineering.

Per-application hook modules expose roughly 40 numbered HTTP command handlers (IHttpDoc interface with getDesc()/getParam()). Documented capabilities include OTP and two-step-verification password capture (the Telegram module hooks SRPHelper.getX() to capture the 2FA password in cleartext), live SQLite queries against the app's encrypted database via reflection on MessagesStorage.database with no query whitelist, contact and address-book harvesting (contacts.vcf), chat history and cache upload, device-authorization enumeration and removal, account takeover and lockout, session manipulation, removal of operator traces, device fingerprinting and installed-app collection, and camera-feed spoofing to defeat identity (KYC) verification. WeChat automation uses LoginWeChat_v1.0.1.js and the _2_0_UploadAppLoginInfo command.

The control plane combines an HTTP callback API (TgHeartCallback, TgRegisterLogCallback, TgReceptionCommandCallback, TgInstallEventCallback, TgRedisStatusChange, hwversion/Upload), Redis buses on Aliyun and Huawei Cloud (key Domain:Basics resolves C2 callback domains), two MQTT buses, Aliyun OSS/MinIO buckets that stage hook payloads (Huuk_<TARGET>/tghuuk_PATCH002_updateinfo) and a SOCKS5 proxy service plus a Thailand relay on Huawei Cloud. A Windows operator console (uip.exe) and a multi-tenant merchant console with role-based access support renting the platform to many operators. Leaked GitLab commit history indicates a Spring Cloud/Kafka/RocketMQ/Nacos backend, account-cultivation features, and about three dozen developers working on UTC+8 timestamps. About 48 hosts were fingerprinted through Censys (Tengine gateway). Five samples were reported contacting control servers, with the latest sample dated 2026-07-29; victim counts are unconfirmed, though C2 artifacts reference victims in China and the United States. The researcher notes Android 17 (API 37) changes break captured Pine but in-process hooking remains viable.

Attribution: infrastructure, certificates and ICP filings tie the platform to three Changsha/Hunan companies: Hunan Youchuang Technology (ucreater.com, com.ucreator namespace), Changsha Sukai Network (ICP filer for qianxuncc.cn) and Changsha Zhuoqing E-commerce (Authenticode signer of uip.exe). A shared Tengine gateway co-tenancy with the Hunan Intelligent Police Public Safety Technology Research Institute was observed, but the researcher states there is no evidence the police developed or operated uCreater. Severity HIGH is analyst-assigned; no CVE or CVSS applies.

## MITRE ATT&CK

- T1660 Phishing
- T1204 User Execution
- T1587.001 Malware
- T1608.001 Upload Malware
- T1655.001 Match Legitimate Name or Location
- T1630 Indicator Removal on Host
- T1417 Input Capture
- T1426 System Information Discovery
- T1418 Software Discovery
- T1409 Stored Application Data
- T1636.003 Contact List
- T1437.001 Web Protocols
- T1544 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1090.002 External Proxy
- T1646 Exfiltration Over C2 Channel

## Sources

- [uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps](https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/)
- [Researchers uncover rentable Android spyware uCreater targeting WeChat and Telegram](https://securityaffairs.com/201764/malware/researchers-uncover-rentable-android-spyware-ucreater-targeting-wechat-and-telegram.html)
- [VirtualApp (app virtualization engine abused by the platform)](https://github.com/asLody/VirtualApp)
- [LSPatch (no-root Xposed-style APK patching used by the platform)](https://github.com/LSPosed/LSPatch)
- [Pine (ART inline-hook engine used by the platform)](https://github.com/canyie/pine)
- [Trend Micro: ActionSpy, prior Android spyware using virtualization to target WeChat/Telegram data (related precedent)](https://www.trendmicro.com/en_us/research/20/f/new-android-spyware-actionspy-revealed-via-phishing-attacks-from-earth-empusa.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4483