uCreator Android Spyware Hooks Telegram and WeChat Inside Virtual Containers

At a Glance

TL;DR

Security researcher Ovi uncovered a commercial surveillance platform tracked as uCreator Android spyware that hooks into messaging and wallet apps without requiring device root access. Sold under the vendor name YingGai, this YingGai uCreator Android spyware platform runs modified builds of Telegram, WeChat, and GCash to steal messages, two-factor passwords, and account sessions. Furthermore, an exposed GitLab server revealed roughly three dozen developers maintaining a multi-tenant cloud console for downstream buyers.

Delivery and Attribution

Rather than tricking victims into installing a standalone utility, operators distribute repackaged copies of legitimate apps like Telegram, WeChat, and GCash through sideloading and social engineering. Alternatively, victims install a multi-account container application called Onion Box. The initial installer stays lightweight and downloads target-specific hook modules after installation from Alibaba Cloud OSS and MinIO storage buckets. While code linked to the uCreator brand dates back to 2014, the analyzed mobile builds and C2 infrastructure span from 2024 through July 2026.

Confirmed Versus Suspected Attribution

Confirmed technical artifacts link parts of the platform to three separate companies in Changsha, Hunan Province. Specifically, domain registrations and a self-signed certificate name Hunan Youchuang Technology, an ICP filing for the main C2 domain names Changsha Sukai Network, and a DigiCert code-signing certificate on a Windows utility names Changsha Zhuoqing E-commerce. In addition, an exposed GitLab server revealed 13 repositories and commit logs from roughly three dozen developers working on China Standard Time, including one developer using a corporate email from a Changsha software firm named Tanzhou.

However, suspected attribution applies to the broader corporate structure and customer base. While a domain tied to the Hunan Intelligent Police Public Safety Technology Research Institute shared a Tengine gateway fingerprint with the spyware network, the Ovi technical report stresses that “Shared cloud ingress demonstrates co-tenancy, not common ownership, collaboration, or operational control.” Based on the resale console and wallet targets, the researcher assesses the operation as financially motivated crimeware rather than state policing software. Although C2 artifacts showed victim data from China and the United States across 48 gateway hosts, the exact number of compromised devices remains unknown.

Infection Chain

While Zimperium previously documented how the GodFather banking trojan uses VirtualApp containers to display fake login overlays, uCreator Android spyware takes a quieter path. Instead of drawing phishing screens, the platform combines VirtualApp sandboxes, the rootless Xposed framework LSPatch, and the Pine Android Runtime hooking engine to modify real app code in memory. As Ovi noted, “The result is more than a conventional banking trojan or a read-only credential stealer. It is a remotely managed Android surveillance platform that can instrument legitimate applications, interact with their authenticated state, and expose application-specific operations to downstream operators.”

In-Process Hooking and Android 17 Limits

For Telegram, the kit ships a repackaged app where LSPatch loads a secondary DEX file from the assets folder at startup. For WeChat, the platform runs the unmodified app inside a VirtualApp container. Once inside the process, the code can spoof camera feeds to bypass know-your-customer liveness checks and intercept one-time passwords.

Testing on a Pixel 10 Pro running Android 17 showed that in-process method hooking still works via Frida. However, the bundled Pine engine inside samples up to July 2026 failed on Android 16 and 17 because Google changed a C++ function signature related to hidden API restrictions in the runtime library.

Command-and-Control and Data-Exfiltration Behavior

Each hooked application starts a local HTTP server with roughly 40 numbered command handlers. Operators send JSON requests over a Redis message bus to execute commands inside the target app’s authenticated session. In the Telegram module, one handler runs raw SQL queries directly against the live MessagesStorage database handle, bypassing disk encryption. Furthermore, the module hooks the password verification routine to steal the user’s two-step verification password in cleartext before hashing, and then hides the attacker’s device from the active session list.

Multi-Tenant Cloud Backend

In contrast, the WeChat module extracts login tokens, zips application data, and uploads contact books to Alibaba Cloud storage. With assistance from researcher Jurre, the investigation uncovered an unallowlisted GitLab server holding the platform’s Spring Cloud backend. The YingGai uCreator Android spyware console stamps every task with a merchant ID, queues jobs through Kafka and RocketMQ, and paces friend-adding and account backups using Nacos schedules to evade anti-fraud checks.

Defense and Detection Guidance

Because the spyware runs inside repackaged applications or virtual containers, users must avoid sideloading messaging or financial APKs from third-party websites. On the host level, defenders can hunt for LSPatch artifacts dropped in the application cache directory or secondary DEX files named TgJarPine.dex. Network administrators should also block traffic to known callback paths such as TgHeartCallback and monitor for connections to unverified Alibaba OSS and MinIO buckets. Finally, security teams should verify application signing certificates against official vendor keys to spot repackaged messengers.

×

Support Our Threat Intelligence

Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.