uCreator

uCreator, also branded YingGai, is a commercially rented Android spyware kit designed to compromise messaging accounts, particularly Telegram and WeChat. It operates through modified applications installed outside official app stores or through an attacker-controlled application container called Onion Box. Its Telegram component is linked to Baohuo through matching code, command infrastructure, and command names. Distribution of that component has included malicious Telegram X applications promoted through in-app advertisements, fake application stores, and third-party Android application repositories.

Within modified Telegram applications, uCreator executes with the host application's identity and permissions, runs a local command server, and downloads application-specific code after installation. It can query Telegram's message database, retrieve chat histories, and intercept two-step verification passwords in plaintext before hashing. Account-control functions include resetting sessions, changing the linked telephone number, deleting accounts, and attempting to exclude the legitimate owner while retaining attacker access. It can also conceal an attacker-controlled session from the session list displayed by the modified application.

The WeChat component can host an unchanged application inside a controlled virtualized container, extract login identity information, upload compressed application data, and clone account access. Its commercial back end provides a multitenant console for merchants and resellers, with commands directed to both phone-farm devices and compromised phones. Functions include capturing login authorizations, collecting contacts and profile information, adding friends in bulk, and backing up accounts. Scheduled activity uses randomized limits, time windows, and per-account budgets to evade platform risk checks. These are supported capabilities; their presence does not establish that every function was exercised against victims.