uCreator spyware hides inside working Telegram and WeChat apps to steal account access

An Android spyware platform called uCreator can steal Telegram’s two-step verification password and extract WeChat login data by operating inside the messaging apps themselves, according to research examined in new reporting by The Hacker News on October 26. The immediate risk is not simply receiving a message: it is installing a tampered app or running a legitimate app inside an attacker-controlled container.

The reporting connects the Telegram component to Baohuo, a backdoor Doctor Web documented in 2025. That overlap puts the latest technical analysis in context: this is new scrutiny of an established spyware operation, not evidence that an entirely new campaign began today.

For people relying on messaging apps for private conversations, the distinction matters. Encryption and an extra login password cannot keep information private from malicious code already running inside the app trusted to handle it.

How a functional messenger becomes a surveillance tool

Researcher Ovi’s analysis, published October 21, describes a rentable platform whose malicious components can operate alongside genuine messaging functionality. A modified app can still send messages and look familiar while exposing account information to an operator.

One route involves repackaging Telegram apps with additional code. Another uses app virtualization: running an app inside a separate hosting application controlled by the spyware’s makers. The research identifies a container called Onion Box among the platform’s components.

Once running, the injected code can intercept functions inside the target app, a technique called hooking. In the Telegram component, that gives operators access to the app’s message database and account-management functions using the app’s own identity and permissions.

This is not a report that ordinary, unmodified installations of Telegram or WeChat are automatically compromised. The documented routes require users to install or run attacker-controlled software. The researchers have not established every victim’s installation path.

Why Telegram’s extra password is exposed

Telegram’s two-step verification adds a password to the login process. Its technical documentation explains that the client uses a cryptographic protocol to prove knowledge of that password without simply sending the password to Telegram’s server.

Ovi found that uCreator’s Telegram code intercepts the password inside the app before it is transformed for that process. The attack therefore does not need to break the cryptography protecting the exchange: it captures the secret at the endpoint where the user enters it.

The analysis also identifies commands for reading chat history, managing authorized sessions and changing account details. Other components are designed to obstruct the legitimate owner while retaining attacker access. These are findings about the code’s capabilities, not proof that every action was successfully carried out against every victim.

The malicious Telegram app can also conceal selected sessions in the device list it displays. That makes a reassuring-looking session list inside the suspect app unreliable. The reports do not establish whether the same hidden session remains visible in a separate, unmodified Telegram client.

The Baohuo link is historical, not a new victim count

The Hacker News compared Ovi’s findings with Doctor Web’s October 23, 2025 disclosure and identified a matching code namespace, command server and command names. Doctor Web’s account describes modified Telegram X copies that kept the messenger working while stealing information and hiding unauthorized devices.

Doctor Web estimated more than 58,000 infected devices at the time of that earlier investigation. That is a historical estimate, not a verified count of current uCreator infections in October 2026.

The earlier investigation traced distribution to advertisements leading to imitation app-catalog websites and to copies found in third-party Android app catalogs. One listing used the genuine developer’s name despite having a different digital signature, the cryptographic marker used to identify an app’s signer.

Ovi’s newer work does not provide a reliable total of affected users. Nor has the connection between the kit’s developers, customers and the particular campaign tracked by Doctor Web been established.

WeChat account cloning and an unresolved Android question

The WeChat component follows a different path. Ovi describes code that extracts login identity, packages app data for upload and uses a bundled script to support account cloning. The researcher distinguishes that capability from the Telegram component’s direct access to message history; the two should not be treated as interchangeable.

There is also no sound basis for declaring a particular Android release immune. A captured hooking engine failed on a tested Pixel running Android 17 because an internal Android function had changed. Another instrumentation tool still worked on that phone. Ovi describes this as a compatibility obstacle for the captured implementation, not proof that Android 17 prevents the underlying technique.

What users should check before trusting their app

The most useful precaution is to check where the messaging app came from. Avoid copies promoted through unsolicited advertisements, imitation download catalogs or promises of special messaging features. An app’s familiar name, working chats or claimed developer identity are not enough to establish authenticity.

If a copy is suspect, do not enter additional passwords into it or use its own security screen as proof that the account is safe. Use a known-clean device and a verified official client to review account access and follow the service’s recovery guidance. Removing a malicious app should not be assumed to revoke access an attacker has already obtained.

A VPN does not fix this kind of compromise. It can protect traffic between a device and a VPN server, but it cannot prevent malicious code inside a messaging app from reading information before transmission. Here, the critical trust decision is which software handles the conversation in the first place.