A rentable Android spyware kit named uCreator is taking over Telegram and WeChat accounts by hiding its malicious code inside otherwise-functional copies of the two messaging apps, The Hacker News reported on 15 October, describing findings from a researcher identifying themselves as Ovi.
The kit does not compromise the legitimate Telegram or WeChat clients distributed through official channels. Exposure begins only when a user sideloads an unofficial build — typically a trojanised APK from an untrusted source — or when a user runs WeChat inside the container app supplied by the kit's operators. In other words, the attack surface is narrow and, in most cases, self-inflicted: uCreator cannot propagate on its own.
How the kit works
The malicious code is embedded directly into working app binaries. Because the tampered client still opens, loads message history and sends messages normally, it passes casual inspection convincingly enough. Critically, the repackaged app inherits the real application's permissions and blends its exfiltration traffic with ordinary network activity, leaving defenders with little behavioural signal to work with.
On the Telegram side, the module captures two-step-verification credentials as they are entered. The Hacker News reports that this component overlaps with Baohuo, a backdoor previously documented in mobile malware research — a lineage note rather than a confirmed attribution, but one that still gives defenders something concrete to hunt for in indicators of compromise. On WeChat, the kit's container-based approach lets it mirror account sessions outright.
That distinction drives remediation. WeChat has no user-chosen 2FA password, so the correct response there is session revocation rather than password rotation. Telegram users face a different exposure: any two-step-verification password typed into an unofficial build should be treated as compromised.
What to do now
- Reinstall from official stores only, and revoke existing sessions on both platforms. Telegram: Settings → Devices. WeChat: Me → Settings → Account Security → Login Devices, where users should sign out unfamiliar or all sessions. Confirm the recovery email address and phone number on each account are still yours.
- Rotate your Telegram two-step-verification password if it was ever entered into a non-official build, and do not reuse it elsewhere.
- Stop running chat apps inside third-party container or wrapper apps. Use the standalone, store-installed client.
- Watch for quiet warning signs: unexpected logouts, unsolicited verification codes, contacts reporting messages you did not send, or anomalous battery and data consumption.
- Treat any APK arriving by direct message as unverified, even when it appears to come from a contact.
Why it matters
For IT teams, the operative policy question is sideloading discipline. On managed and BYOD devices alike, allowing installation from unknown sources effectively hands the decision to the attacker's delivery chain. Since repackaged apps beat lookalikes on detection — the fake behaves like the real thing — source control is the single most effective defence, ahead of behavioural monitoring. Because the exposure path begins with a user-initiated install, an organisation that enforces official-store-only deployment for messaging apps largely neutralises the kit before any monitoring is needed.
The findings, as reported, rest on a self-identified attribution and a Baohuo lineage link that The Hacker News frames as an overlap; both should be treated as provisional pending fuller documentation of the source research.
The Hacker News 於 10 月 15 日報道，一套名為 uCreator、可供租賃的 Android 間諜軟件套件，正透過將惡意代碼隱藏於兩個通訊應用程式看似正常運作的副本之中，以接管 Telegram 及 WeChat 帳戶。報道引述一名自稱 Ovi 的研究員所披露的發現。
該套件並不會入侵經官方渠道發佈的正版 Telegram 或 WeChat 客戶端。風險僅在用戶側載（sideload）非官方版本時開始——通常是來自不可信來源的木馬 APK——或者用戶在該套件營運者提供的 container 應用程式內運行 WeChat。換言之，攻擊面相當狹窄，而且在多數情況下屬用戶自招：uCreator 無法自行傳播。
套件運作方式
惡意代碼直接嵌入可正常運作的應用程式二進位檔案之中。由於遭篡改的客戶端仍可正常開啟、載入訊息記錄及發送訊息，它足以令人信服地通過一般檢查。關鍵在於，重新封裝的應用程式繼承了真實應用程式的權限，並把其外洩流量混入一般網絡活動之中，令防禦方幾乎沒有行為訊號可供追查。
在 Telegram 方面，該模組會在用戶輸入 two-step-verification 認證資料時加以截取。The Hacker News 報道，此組件與 Baohuo 有所重疊——後者是先前在流動惡意軟件研究中記錄過的後門程式。這只是譜系上的註記，並非確鑿的歸因，但仍為防禦方提供了可在指標妥協（indicators of compromise）中具體追查的線索。在 WeChat 方面，該套件的 container 方式使其能夠直接鏡像帳戶的會話（session）。
此一差異決定了相應的補救措施。WeChat 沒有用戶自選的 2FA 密碼，因此正確的應對方式是撤銷會話，而非更換密碼。Telegram 用戶則面對不同風險：任何在非官方版本中輸入的 two-step-verification 密碼，都應視為已外洩。
現時應採取的措施
- 只從官方商店重新安裝，並撤銷兩個平台的現有會話。 Telegram：Settings → Devices。WeChat：Me → Settings → Account Security → Login Devices，用戶應在此登出不熟悉的或全部會話。確認兩個帳戶的 recovery email 地址及電話號碼仍然屬於你。
- 更換你的 Telegram two-step-verification 密碼，切勿在其他地方重用。 只要該密碼曾於任何非官方版本輸入，便應視作已外洩。
- 停止在第三方 container 或封裝（wrapper）應用程式內運行聊天軟件。 請使用獨立的、從商店安裝的客戶端。
- 留意不易察覺的警號： 意外登出、無故收到驗證碼、聯絡人表示收到你並沒有發出的訊息，或電池及數據用量異常。
- 視任何經私訊傳來的 APK 為未經核實，即使它看似來自你的聯絡人。
為何值得關注
對 IT 團隊而言，最切實的政策問題是側載紀律。無論是公司管理的裝置還是 BYOD 裝置，容許從未知來源安裝，等同將決定權交到攻擊者的投放鏈手上。由於重新封裝的應用程式在偵測上比單純仿冒更難應付——仿冒品的行為跟真品無異——來源控制是比行為監測更為有效的首要防禦。由於風險路徑由用戶主動發起安裝開始，一所強制要求通訊軟件只從官方商店部署的機構，基本上已在任何監測介入之前便已化解了該套件的威脅。
上述發現如報道所述，建基於一項自我聲明的歸因，以及 The Hacker News 所描述的、與 Baohuo 之間的譜系重疊；兩者在源研究獲得更完整文件佐證之前，均應視為暫時性結論。