Ethical Hacking News
The uCreator spyware is a sophisticated Android malware capable of stealing Telegram 2FA passwords and cloning WeChat accounts. This report provides a detailed analysis of the uCreator spyware, its operations, and its implications for Android users. Learn how to protect yourself against this threat and stay up to date with the latest cybersecurity news and trends.
The uCreator spyware is a sophisticated Android spyware that can steal Telegram 2FA passwords and clone WeChat accounts.The spyware was discovered to originate from a company based in Hunan province, China, known as YingGai.The uCreator spyware can spread through sideloading, social engineering, and a custom-built container app.The spyware has a sophisticated hooking engine that allows it to intercept and manipulate app functions.The spyware has a complex back-end code structure with a cloud console for merchants to control its operations.Indicators of compromise include SHA-256 hashes, domain names, and IP addresses.Users are advised to use security software, keep their OS and apps up to date, and be cautious with app installations.
The cybersecurity landscape has recently been marred by the discovery of a sophisticated Android spyware, dubbed uCreator, which has been found to possess the capability to steal Telegram 2FA passwords and clone WeChat accounts. The uCreator spyware, initially reported by researcher Ovi, has been identified as a rentable Android spyware kit that operates by hiding its code within working copies of the Telegram and WeChat apps. This cunning tactic allows the spyware to bypass traditional security measures and gain unauthorized access to the victim's account.
According to a recent article published on The Hacker News, the uCreator spyware is believed to have originated from a company based in Hunan province, China, known as YingGai. The spyware was discovered to be spread through various means, including sideloading, social engineering, and the use of a custom-built container app called 洋葱盒子 ("Onion Box"). The kit's creators can also sell the spyware as a product, allowing customers to remotely control it against any app they wish to target.
The uCreator spyware has been found to possess a sophisticated hooking engine that allows it to intercept and manipulate the functions of any app on the infected device. This capability enables the spyware to steal sensitive information, including 2FA passwords, and use it to access and control the victim's account. Furthermore, the spyware has been discovered to be able to clone WeChat accounts, allowing its creators to potentially use the stolen accounts for malicious purposes.
The uCreator spyware has also been found to have a complex back-end code structure, which includes a cloud console that merchants and resellers can rent to control the spyware's operations. The code includes a scheduler that sets time windows, random daily limits, and per-account budgets, allowing the creators to tailor the spyware's activity to avoid detection by platforms.
Researchers have identified several indicators of compromise associated with the uCreator spyware, including SHA-256 hashes, domain names, and IP addresses. These indicators can be used to track and identify the spyware, helping to prevent its spread and mitigate its impact.
In light of this discovery, it is essential for Android users to take proactive measures to protect themselves against the uCreator spyware. This can include using reputable security software, keeping their operating system and apps up to date, and being cautious when installing new apps from unknown sources.
The discovery of the uCreator spyware highlights the ongoing threat of sophisticated Android malware and the need for continued vigilance in the cybersecurity community. As the threat landscape continues to evolve, it is crucial that users and developers remain vigilant and work together to develop effective countermeasures against such threats.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Discovery-of-uCreator-A-Sophisticated-Android-Spyware-Capable-of-Stealing-Telegram-2FA-Passwords-and-Cloning-WeChat-Accounts-ehn.shtml
https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html
Published: Mon Oct 26 12:55:29 2026 by llama3.2 3B Q4_K_M
