On October 21, Ovi detailed Telegram spyware copying 2FA passwords

uCreator, a rentable Android spyware kit, hides its code inside working copies of Telegram and WeChat. Its Telegram module hooks the exact moment a user types their two-step verification password, copying it in readable form before the app hashes it into a login proof. Researcher Ovi, who published the analysis on October 21, 2026, pulled that detail from the code itself, not from a live campaign.

The kit only reaches people who install a tampered copy of one of these apps, sideloaded or spread through social engineering, or who run WeChat inside the makers’ own container app, called 洋葱盒子 (“Onion Box”). Some of the fake Telegram X builds carry the same package name as the real app on Google Play, so the name alone will not flag them. Copies turned up in the third-party stores APKPure, ApkSum and AndroidP; on APKPure one was listed under the official developer’s name with a different signature.

The Telegram half has been seen before. Doctor Web reported the same backdoor, which it called Baohuo, in October 2025, after finding it in tampered Telegram X copies on more than 58,000 devices. The Hacker News lined up the two reports and found the same code namespace, com.ucreator.tgjar, the same C2 server, and matching command names. Ovi’s write-up does not mention Doctor Web, and Doctor Web never named the kit, so whether the 58,000-device campaign was run by the makers or one of their customers is unknown. Doctor Web found Baohuo spreading since mid-2024 through in-app ads that led to fake app-store sites pitching Telegram X as a dating and video-chat app. The banners ran only in Portuguese for Brazil and in Indonesian, yet Doctor Web’s 2025 infection map put India first at 22.8%, ahead of Brazil at 20.5% and Indonesia at 9.6%.

How the Telegram takeover works

Inside a tampered app, the kit’s code starts when the app starts and runs with the app’s own identity and permissions. It gets whatever the signed-in app gets. Each tampered build also runs a local command server inside itself, and the per-app attack code is downloaded after installation, which makes the installer file harder to analyze on its own.

From there the operator can send arbitrary database queries to the message store and pull back chat history. The 2FA capture is the sharper trick: because the password passes through the app in plaintext on its way to becoming a login hash, a hook on that step hands the operator the real password. With it, the code can reset the account’s active sessions, change the linked phone number, or delete the account, and other parts are built to lock the owner out while keeping the attacker’s session alive. It can also hide that session from the device list the tampered app shows the user. Doctor Web described the same session-hiding, plus a beacon that sends the account’s phone number, name and password to the server every three minutes.

Two caveats from Ovi are worth keeping. Neither his report nor Doctor Web’s says whether a hidden attacker session still shows up on the victim’s other, untampered Telegram clients, and neither gives steps for recovering a compromised account. The code demonstrates capability; it is not evidence that operators have run every step from start to finish.

The technique of running a legitimate app with attacker code inside it has precedent. FjordPhantom did it to banking apps through virtualization in 2023, and the GodFather trojan did it in 2025. Ovi’s argument for why this kit matters is that it is sold as a product: customers can steer it remotely against any app the makers write a module for.

The WeChat half and the leaked console

For WeChat the kit can skip tampering and use virtualization instead, running the unmodified app inside its container. One command copies out the account’s login identity, zips and uploads the app’s data, and a bundled script clones the account elsewhere. This targets the account itself rather than its chat history.

Ovi and a second researcher, Jurre, found the kit’s back end on a self-hosted GitLab server, the one piece of the setup not restricted to an allowlist of IPs. It is a cloud console that merchants and resellers rent. Every command carries a customer ID, so each renter points their own slice of a phone fleet at targets they choose. Commands flow to the operation’s own phone farm and to victims’ phones, where the kit captures login authorizations, mass-adds friends, scrapes contacts and profiles, and backs up whole accounts. A scheduler applies time windows, randomized daily limits and per-account budgets so the traffic reads as human and clears the platforms’ risk checks; the code calls this “account cultivation.” About three dozen developers, all on China time, show up in the history, some still committing in October 2026. The leaked back end covered personal WeChat and WeCom accounts, did not appear to cover Telegram, and sat on only one of several GitLab servers.

Attribution and targets

Ovi ties the operation to three companies in Hunan province, China, through a brand website and server certificate, a government filing for a command server, and the signature on the kit’s Windows control program. He calls a shared owner “plausible, but remains unproven.” The product’s own name is YingGai, with records going back to September 2021; the samples studied run from 2024 to July 2026.

The apparent targets, still unconfirmed, are mobile wallet and messaging users in China and Southeast Asia: WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber, GCash and MoMo. Ovi found code for about 20 apps but published modules only for Telegram and WeChat. The command server he accessed held victim data pointing to China and the United States, too little for a count; he is explicit that the report measures technical capability, not victim impact. Given the focus on wallets and one-time codes, he reads the kit as financially motivated. Doctor Web, looking at the same Telegram backdoor, described it as a tool for inflating Telegram channel subscriber counts.

One point for defenders weighing the Android version: Ovi tested the hooking engine on a Pixel 10 Pro running Android 17 and it failed to find an internal Android function it depends on, because newer versions changed that function. Frida could still hook apps the same way on that phone, so he treats this as extra work for the makers rather than Android 17 blocking the attack. The newest sample, from July 29, 2026, still shipped the old engine. He recovered Android 16 builds but did not test them, and has not tested phones from Chinese vendors.

What to look for

Ovi names two on-device traces he considers reliable. One is a code file, TgJarPine.dex, in the assets of some tampered Telegram copies. The other is the original app that LSPatch, an off-the-shelf patching tool, leaves behind at cache/lspatch/origin/*.apk; since that artifact comes from LSPatch itself, it can show up in apps patched with the tool for unrelated reasons, so treat it as a lead rather than a verdict.

When The Hacker News checked on October 23, 2026, several of the kit’s command and download domains no longer resolved, but the version-upload host hw.android.videoflow[.]cn still pointed to 121.37.194[.]194.

File hashes (SHA-256):

• 2fc4bad71eda25b9022ea7cb090d6419911ecd67e50e746b418f8a617a980301 (com.ucreator.tg, framework and command handlers)
• 0142749a159be3e41d28f910eebf28b577a282880bd0c2383bd7404189f4ff94 (com.uckj.tgx, loader)
• dcec9640271a782553599197bcb85367971a5bb4aa84c3787d1e49a3f4f9420e (tampered Telegram X, November 2024)
• 805834e6b8c12e180117a1816b48e387c33b53520f5a91cbf858441dc895e717 (tampered Telegram, July 2024)
• a90e3ab2b5cf306439a378faf7107a89196116ad7ee4ad5791c2ba8839ba21c4 (tampered Telegram X)
• f82ac2c525d1ed82e57b3f27ae689aeda46875a893ca4c42876b3166ba66bb20 (com.ucreator.va_vx, WeChat host)
• 99c5be579d218acfd2c7e2662528e7ad32a1a605d8efd1da732c13931bc30c4c (com.ucreator.va_yjb_client, Onion Box)
• 9c8b147f76312e651faabb1411a3270efca984dd8f33bd8ded3ea611c7c583a1 (uip.exe, Windows control program)

Network indicators:

• hpncallback.gold5play[.]com, hpncallback.qianxunlbs[.]com (command servers, not resolving on October 23)
• telegram-apk.uzyzx[.]com (download host, not resolving on October 23)
• hw.android.videoflow[.]cn (version uploads, pointing to 121.37.194[.]194)
• 159.138.237[.]10:32115, 159.138.229[.]12:26379 (Redis servers)
• r-bp1jehsclgbuu48m7tpd.redis.rds.aliyuncs[.]com:65531 (Redis, WeChat part)
• 43.225.141[.]209 (relay used by the Telegram part)
• kfpt.oss-cn-hangzhou.aliyuncs[.]com/android/app/YingGai/ (hook downloads)

Doctor Web has published its own indicators for Baohuo.