TechCapsules

AI-summarised brief · reviewed before publication

A rent‑a‑spyware kit named uCreator embeds malicious code in counterfeit copies of Telegram and WeChat, allowing attackers to hijack accounts, steal Telegram two‑factor authentication passwords, and clone WeChat sessions. The kit’s Telegram module matches the Baohuo backdoor previously reported by Doctor Web, sharing the same namespace (com.ucreator.tgjar), C2 server and command set. Infections spread via sideloaded APKs, fake app‑store sites targeting Portuguese‑speaking Brazil and Indonesian users, and a container app called “Onion Box” that runs other apps inside it. By running with the victim app’s identity, the malware can query message databases, exfiltrate phone numbers, names and passwords, and conceal attacker sessions. Samples dated July 2026 still use an older hooking engine, but the threat persists across Android 16–17 devices, with victims reported in China, the United States, India, Brazil and Indonesia.