GitLab leak exposes Chinese spyware platform uCreator

Researcher Ovi found an unprotected self-hosted GitLab server containing the full backend source of uCreator (branded YingGai), a commercial surveillance service that steals Telegram 2FA inside the app's own process without root. Doctor Web's Baohuo campaign has infected over 58,000 devices, with India leading at 22.8%.

• The exposed GitLab server held 13 repositories with C2 code and commit history
• The platform uses VirtualApp, LSPatch and Pine to hook inside Telegram's process
• The Baohuo campaign infected over 58,000 devices, 22.8% in India
• Hook modules are fetched post-install from Alibaba OSS and MinIO