uCreator Android spyware steals Telegram 2FA and hijacks WeChat accounts

Researcher Ovi found a rentable Android spyware kit called uCreator that takes over Telegram and WeChat accounts by hiding code inside tampered copies of the apps. It only infects users who install those copies outside official app stores or run WeChat in the kit makers' container app.

• uCreator is distributed as a rentable kit, not a standalone virus
• Its Telegram module matches the Baohuo backdoor
• Infection requires installing a tampered copy outside app stores
• WeChat is exposed when run in the makers' container app