uCreator Android Spyware Targets Telegram and WeChat Accounts

A rentable Android spyware kit called uCreator can steal Telegram credentials and help attackers clone WeChat accounts, according to The Hacker News. The threat matters to households because it hides inside working copies of familiar messaging apps, and victim data found on one command server apparently included people in the United States.

What happened

Researcher Ovi found uCreator code embedded in altered versions of Telegram and WeChat. The spyware reaches users who install tampered app files from outside official app stores or run WeChat inside a separate container app called Onion Box.

The Telegram component matches Baohuo, a backdoor previously investigated by Doctor Web, The Hacker News reported. Doctor Web estimated in 2025 that more than 58,000 devices had been infected. It found altered Telegram X apps distributed through advertisements, fake app-store pages and third-party stores including APKPure, ApkSum and AndroidP.

Some malicious copies used the same Android package name as the genuine Telegram X app. One third-party listing also displayed the official developer’s name even though the app had a different digital signature. This means an app’s name and listing alone may not reveal that it has been altered.

Once running, the malicious code has the same access and permissions as the signed-in messaging app. Ovi found that attackers could retrieve Telegram chat history and intercept the password used for Telegram’s two-step verification before the app processed it. The kit could also help an attacker change the linked phone number, remove sessions, delete an account or hide an attacker-controlled session from the device list shown in the altered app.

Ovi tested the hooking engine on a Pixel 10 Pro with Android 17 and found that the current sample could not locate one Android function it needed. However, another tool could still hook apps on that phone, so the researcher did not claim Android 17 prevents the attack.

Who is affected

The clearest risk is to Android users who installed Telegram, Telegram X or WeChat from a website, advertisement, downloaded APK file or unofficial app store. People who used the Onion Box container app should also treat their messaging accounts as potentially exposed.

The available evidence does not provide a reliable victim count for the current uCreator operation. Ovi found apparent victim records from China and the United States, but described the research as an examination of the kit’s abilities rather than a measurement of its reach.

What to do now

1. Open Android Settings, go to Apps, and review Telegram, Telegram X, WeChat and Onion Box. If you installed any of them from a downloaded file, advertisement or third-party store, treat that copy as suspicious.

2. Uninstall the questionable messaging app and Onion Box. Do not rely on the app’s displayed name or developer label to decide that it is genuine.

3. Reinstall Telegram, Telegram X or WeChat only from the official Google Play listing. Avoid replacement APK files offered through ads, chat messages or download sites.

4. From a clean, official Telegram app, change your two-step verification password. Use a new password that you have not used for another account, because the spyware can capture the existing password in readable form.

5. In the official Telegram app, open Settings and review the device or session list. End sessions you do not recognize. Do this only after replacing the altered app, since uCreator can hide an attacker’s session inside its tampered version.

6. Check that the phone number linked to your Telegram account is still yours. Do not assume a newer Android version alone stopped the spyware; the testing cited by The Hacker News did not establish that Android 17 blocks the attack.