{"id":245996,"date":"2026-10-27T05:37:32","date_gmt":"2026-10-27T10:37:32","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/10\/ucreator-android-spyware-can-steal-telegram-2fa-passwords-and-clone-wechat-accounts"},"modified":"2026-10-27T05:37:32","modified_gmt":"2026-10-27T10:37:32","slug":"ucreator-android-spyware-can-steal-telegram-2fa-passwords-and-clone-wechat-accounts","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/10\/ucreator-android-spyware-can-steal-telegram-2fa-passwords-and-clone-wechat-accounts","title":{"rendered":"UCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts"},"content":{"rendered":"\n<p>A rentable Android spyware kit called <strong>uCreator<\/strong> takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, <a href=\"https:\/\/www.0x0v1.com\/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps\/\" target=\"_blank\">researcher Ovi found<\/a>. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the kit makers\u2019 own container app.<\/p>\n<p>The kit\u2019s Telegram part matches <b>Baohuo<\/b>, a backdoor that Doctor Web <a href=\"https:\/\/thehackernews.com\/2025\/10\/weekly-recap-wsus-exploited-lockbit-50.html\" target=\"_blank\">reported in October 2025<\/a>. Doctor Web found Baohuo in tampered copies of Telegram X, an Android app from Telegram. At the time, the company estimated that more than 58,000 devices were infected.<\/p>\n<p>The Hacker News compared the two reports. Doctor Web\u2019s technical description of Baohuo lists the same code namespace, com.ucreator.tgjar, the same command-and-control (C2) server, and matching command names as Ovi\u2019s analysis.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the kit makers\u2019 own container app. [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,6],"tags":[],"class_list":["post-245996","post","type-post","status-publish","format-standard","hentry","category-biotech-medical","category-robotics-ai"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/245996","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=245996"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/245996\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=245996"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=245996"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=245996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}