An Android surveillance kit called uCreator, also sold under the name YingGai, runs inside modified copies of Telegram and WeChat and can read the two-step verification password a Telegram user types in. A security researcher who goes by Ovi published the analysis on October 21, 2026, after finding leaked back-end code for a platform that customers rent through a cloud console.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
The Hacker News reported the findings on October 29. The newest sample Ovi examined is dated July 29, 2026, the leaked server code was still being updated as recently as October 2026, and the product line shows up in records going back to September 2021.
App virtualization replaces the fake login screen
In his report, Ovi describes uCreator as a commercial platform built around the Chinese term qunkong, meaning mass control. Instead of painting a fake login screen over a real app, it uses app virtualization and no-root hooking tools, VirtualApp, LSPatch and Pine, to run the kit’s code inside the target app’s own authenticated process. The malicious code therefore holds the same permissions as Telegram or WeChat and sees whatever the app sees.
Ovi says recovered code supports intercepting one-time passcodes, extracting wallet and messenger data, manipulating sessions, spoofing the camera to beat identity-check liveness tests, and harvesting contacts. The code supports about 20 apps, though the published portion covers only Telegram and WeChat. The wrapper app that carries them is called Onion Box, written 洋葱盒子 in Chinese, according to The Hacker News.
Ovi’s testing shows the kit is not frictionless on new hardware. On a Pixel 10 Pro running Android 17, its hooking engine failed to find one internal function, though the general-purpose Frida toolkit could still hook apps on the same phone. The lineage is long: a package named com.ucreater.autotool dates to about 2014, Windows tooling tied to ucreater.com was signed between 2016 and 2019, the mobile YingGai line appears from September 2021, and the analyzed Android artifacts run from 2024 to 2026. The leaked back end’s commit history reaches October 2026, so maintenance was continuing while the findings were being written.
The hook sits before Telegram hashes the password
The Telegram module hooks a routine named SRPHelper.getX, which Telegram uses to compute a proof for its two-step verification cloud password under the secure remote password protocol. Because the hook sits before the password is hashed, Ovi writes, it reads the password in cleartext from the function’s argument and stores it for upload. With that password the operator can list and reset authorized sessions, change or confirm the bound phone number, or delete the account.
Other classes, named Uc_Business_RefuseLogin and Uc_Business_Frozen, are built to lock the legitimate owner out while the attacker’s session stays alive, and the module can remove its own session from the device list so the owner does not see it. Ovi cautions that not every step has been confirmed end to end.
WeChat is handled differently. The kit runs the unmodified WeChat app inside its own container, copies the account’s login identity with a command, zips the app’s data and uploads it, and then uses a bundled login script to clone the account elsewhere. Ovi says this targets the account itself rather than the chat history.
A product that merchants and resellers rent
The leaked back end points to a multi-tenant console in which merchants and resellers rent access, with each command tagged by a merchant ID. Neither Ovi nor The Hacker News gives a rental price. Ovi links parts of the operation to three companies in Changsha and Hunan province but calls common ownership plausible and unproven, and his working assumption is financially motivated crime software. About three dozen developers appear in the code history, all working on China time.
A second researcher, who goes by Jurre, helped find the leaked code. The Hacker News also tied the finding to an earlier Telegram backdoor, Baohuo, which Doctor Web reported in 2025, estimating more than 58,000 infected devices, with India at 22.8 percent, Brazil at 20.5 percent and Indonesia at 9.6 percent. Doctor Web did not name the kit behind Baohuo, and its malware description and indicator list are public for defenders.
The Baohuo comparison shows how fast stolen Telegram access can move. According to The Hacker News, that backdoor sends an account’s phone number, name and password to its server every three minutes, leaving little time between a user entering credentials and an operator holding them. The 58,000-device count describes Baohuo, not uCreator, and nothing in the reports reviewed ties the two codebases together.
Ovi stresses that the report analyzes capability rather than victim counts. How many people have installed a tampered Telegram or WeChat build, and who among them has had a two-step password copied, remains unmeasured. Ovi’s report also leaves open whether the three Hunan companies he links to the operation are the developers, the sellers or only the hosts, which is the question that would decide who answers for it.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
- Common allergy, bladder and sleep pills tied to sharply higher dementia odds
- NOAA now gives this winter a 75% chance of the strongest El Nino since 1950
