A commercial Android spyware kit called uCreator hides inside modified versions of legitimate messaging apps, including Telegram X. Victims who sideload these lookalike apps may expose Telegram two-step verification passwords or have WeChat account data copied, even while the altered app continues to work normally.
uCreator is a commercial Android spyware kit that attackers build into modified, lookalike versions of legitimate apps such as Telegram X. Victims are drawn to download these apps outside official app stores, often through a download site that presents the app as a normal or alternative way to install a messaging service. Once sideloaded, the app looks and behaves like the real thing while secretly running malicious code in the background.
For Telegram, the spyware can capture the two-step verification password before the legitimate app hashes it, intercepting the credential at the moment of entry. For WeChat, the malware can run the app inside a virtual container, extract account data, and support account cloning. The kit's code supports roughly 20 messaging apps and mobile wallets, which gives renters of the kit many possible targets.
The core weakness this attack exploits is trust in app appearance rather than app source. Tampered apps built with uCreator can still function normally and connect to the real services' official servers, so there is little visible evidence anything is wrong. A victim can send messages, log in, and use the app as expected while their credentials and account data are quietly exposed. This is reinforced by the practice of sideloading, installing an app from a website or link instead of an official store, which removes the vetting checks that app stores normally provide.
Organizations and individuals can reduce exposure to this kind of spyware with a few consistent habits:
IT and mobile device management teams should also consider reinforcing app installation policies for employees who rely on Telegram, WeChat, or mobile wallet apps for work.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
uCreator is a commercial Android spyware kit that hides malicious code inside modified versions of legitimate apps, including Telegram X, and is offered through a rental model supporting roughly 20 messaging apps and mobile wallets.
It can capture a Telegram two-step verification password before the legitimate app hashes it, meaning the credential is intercepted at the point of entry.
Yes, tampered apps built with uCreator can still function normally and connect to the real services' official servers, which can create false confidence that nothing is wrong.
Only install messaging and wallet apps from official app stores rather than sideloading from download sites, and keep Android updated since newer OS protections have made the exploit harder to run.
Your Telegram X app works. That doesn't mean it's safe. A download site says, 'Install Telegram X.' You sideload its Android package, sign in, and enter your two-step password. uCreator can capture it before the app hashes it. Here's the trap: the altered app may still connect to the real service. A fake WeChat update can work normally while uCreator copies account data for cloning. The giveaway is where it came from. Install messaging apps only from your official app store or verified company source.
Researchers linked the uCreator Android spyware kit to real campaigns that used ads and fake app-store sites to distribute tampered Telegram X apps. The sites marketed Telegram X as a dating and video-chat app, persuading victims to sideload it; once installed, the altered app could steal Telegram…
UK, US and Dutch authorities warned that Iran-linked attackers are targeting dissidents, activists, and journalists with Windows spyware. The group builds trust over messaging apps, then tricks victims into downloading malware disguised as legitimate software (or even medical files). The spyware…
Researchers investigated a fake Android app posing as a Chinese public security bureau service and traced it to a broader criminal ecosystem using a leaked Android remote-access tool (RAT) framework called “Flying Eagle.” The tooling lets criminals build convincing look‑alike apps and then steal…
Researchers say the Kazakhstan-linked group “Silent Lynx” has run real espionage campaigns across Central Asia, targeting government bodies and energy organizations. The reported entry method relied heavily on spear‑phishing sent from compromised government email accounts, sometimes using trusted…
A real campaign is targeting logistics firms with fake Google Play pages impersonating well-known logistics brands to trick employees into installing an Android spyware app. Once installed, the spyware can steal newly received SMS messages (including one-time passcodes) and enable call forwarding,…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
