As reported by The Hacker News, a rentable Android spyware kit dubbed uCreator is compromising Telegram and WeChat accounts by embedding malicious code inside functional — but tampered — copies of those apps. The Telegram component matches the Baohuo backdoor tracked by Doctor Web in October 2025, which had already infected more than 58,000 devices. This is not a one-off campaign; it is a maturing malware-as-a-service (MaaS) operation with measurable reach.

Threat Alert: This is not a one-off campaign; it is a maturing malware-as-a-service (MaaS) operation with measurable reach.

Why This Matters Beyond the Headline

The most consequential detail isn't the spyware's capability — it's the distribution model. uCreator is rented out, which means the operator's success depends on making trojanized APKs indistinguishable from legitimate ones. Some samples even reuse the official Telegram package name, so a quick check of the app label is not a reliable defense. Combined with placement on third-party stores such as APKPure — including one listing under the legitimate developer's name — this kit exploits the trust users place in app metadata rather than technical vulnerability.

For enterprise defenders, this reframes a familiar problem. The threat isn't a CVE in Telegram or WeChat; it's a supply-chain and provenance failure on the Android side. MDM policies that allow sideloaded apps or restrict only to Google Play are insufficient when third-party stores host look-alikes with valid-enough metadata.

The Hooking Engine Is the Real Story

Ovi's analysis points to a hooking engine that intercepts in-app behavior — the same mechanism used by banking trojans to overlay login screens and harvest credentials. When applied to messaging platforms, the attacker gains something more valuable than a password: session persistence and 2FA bypass. Stealing a Telegram 2FA password after the account is already authenticated gives the operator durable control, including the ability to read messages, impersonate the victim, and pivot into business communications running over WeCom or Telegram.

The kit reportedly supports around 20 apps including WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber, GCash, and MoMo — but only Telegram and WeChat code has been published. Treat the published samples as a partial view, not the full capability set.

Who Is Most Exposed

The Hooking Engine Is the Real Story
BYOD fleets with Android devices used for both personal and corporate messaging — especially teams that communicate over WeCom, Telegram, or regional apps like Zalo and MoMo.
Financial sector employees in APAC using GCash, MoMo, or similar mobile wallets on the same device as compromised messaging apps.
Users in India, Brazil, and Indonesia — the top three infected regions per Doctor Web's 2025 telemetry — though China and U.S. victims also appear in the kit's C2 data.
Anyone sideloading APKs from APKPure, ApkSum, or AndroidP, where trojanized builds have appeared.

Shield53 Recommendations

  • Block sideloading and third-party stores at the policy layer. Google Play Integrity API + managed Google Play should be the only sanctioned source for corporate Android. Where sideloading is unavoidable, require signed APKs from an approved internal repository.
  • Inventory messaging and wallet apps across your Android fleet. Flag any Telegram or WeChat installation that did not come from the official store. Compare package signatures against vendor-published signing keys.
  • Detect the indicators. The code namespace com.ucreator.tgjar and the Baohuo C2 infrastructure are documented — push them into your MDM/EDR IOC feeds immediately. YARA rules for the hooking engine payload should follow once samples are shared through ISAC channels.
  • Treat messaging compromise as an identity incident. If a user's Telegram or WeCom session is hijacked, rotate the associated SSO, business email, and any 2FA secrets the attacker could have observed via message reads. Do not assume the breach stopped at the app.
  • Hunt for the Onion Box container. The kit's own container app (洋葱盒子 / Onion Box) is a separate delivery vector. Block its package hash in MDM and alert on any Android device running nested app-container frameworks unless explicitly approved.
  • Brief high-risk users now. Finance, legal, and executive teams in APAC should be told directly: do not install Telegram, WeChat, or any messaging app from sources other than Google Play or the vendor's official site. Phishing via fake app-store landing pages remains the primary ingress.

The uCreator kit is a reminder that on mobile, the application layer is the perimeter. Patching won't help when the attack is delivered as a look-alike binary. Defenders need provenance controls, signature verification, and IOC-driven hunting — not just vulnerability management.