uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts
Summary: A rentable Android spyware kit called uCreator hides its code inside working copies of Telegram and WeChat, and researcher Ovi found its Telegram component matches Baohuo, a backdoor Doctor Web reported in October 2025 with an estimated 58,000-plus infected devices. The kit hooks Telegram's in-app two-step verification step to copy the password in readable form before hashing, and for WeChat it can run the unchanged app inside its own container, copy out the login identity, and clone the account.
Key Takeaway: With the 2FA password in readable form, the code can reset logged-in sessions, change the linked phone number, or delete the account - and it can hide the attacker's session from the device list the tampered app shows the user. Ovi's command server held victim data apparently from China and the United States, and about three dozen developers, some still committing in October 2026, appear in the code's history.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026