A sophisticated spyware, known as uCreator, is posing significant threats to users of Telegram and WeChat by infiltrating their accounts. This malicious tool, identified by researcher Ovi, disguises itself within legitimate versions of these apps, affecting those who download altered versions from unofficial sources or use a specific container app provided by the spyware’s creators.
Details of the uCreator Threat
The spyware’s connection to Baohuo, a backdoor previously documented by Doctor Web, reveals its complex nature. Doctor Web had identified Baohuo in tampered Telegram X applications, noting a widespread impact on over 58,000 devices. This analysis aligns with Ovi’s findings, which highlight similar coding structures and command servers, yet Doctor Web’s and Ovi’s analyses do not completely overlap in their findings.
The spyware spreads through sideloading, allowing users to install apps directly from files rather than app stores, and through social engineering tactics. Another method involves a container app called ‘Onion Box,’ which runs other applications within itself. The spyware’s reach is further extended as some tampered Telegram X versions mimic the official app’s package name, making them difficult to detect.
Impact and Distribution
Doctor Web discovered that the compromised apps have been circulating since 2024, advertised through misleading in-app ads leading to fake app stores. These sites, targeting users primarily in Brazil and Indonesia, falsely presented Telegram X as a dating or video chat application. Despite the geographic focus, India recorded the highest infection rate.
Ovi accessed a command server, uncovering victim data potentially located in China and the United States, although the extent of the infection remains unclear. The spyware’s main targets are mobile wallet and messaging app users in China and Southeast Asia, including platforms like WeCom, QQ, and WhatsApp, with support for about 20 apps in total.
Technical Analysis and Future Outlook
The spyware enables attackers to intercept app functions by utilizing a hooking engine, though recent Android updates have introduced challenges for older methods. However, alternative tools like Frida continue to facilitate these attacks. The spyware’s persistence is evidenced by newer samples still using outdated engines, indicating ongoing development.
In addition to compromising Telegram accounts, the spyware employs virtualization to clone WeChat accounts, bypassing security measures by extracting and uploading login data. This advanced method focuses on account access rather than chat history.
Researcher Ovi links the spyware’s development to companies in China’s Hunan province, yet definitive connections remain speculative. The product, known as YingGai, has been in circulation since 2021, with its usage likely driven by financial motives, emphasizing the importance of enhanced security practices for users and developers alike.
